Skip to content

Potential heap corruption in fs::SPIFFSFS after PR #4443 #4491

Closed
@thewavelength

Description

@thewavelength

@me-no-dev I think I've found a potential bug in my PR #4443.

Accidentally, I've created a local helper function in my project where I accept fs::SPIFFSFS as parameter - you can see: I forgot the reference. The correct declaration for my helper function parameter would have been fs::SPIFFSFS &. It cost me an hour of debugging because the compiler didn't spit out any error or warning. The error was a heap corruption.

While normally one should not copy fs::SPIFFSFS because obviously it can have unintended side effects, it did happen to me.

I don't know the implementation details of that class, but it could be PR #4443 is the root cause:

There is no copy constructor defined, so the compiler generates the default one. The default copy constructor will plainly copy all POD types and this happens to the member variable pointer partitionLabel_. Then, when the local helper function in my project is returning, the destructor is called, the heap will be freed and now in the original instance, partitionLabel_ points to invalid heap memory.

There are the following solutions to this:

  1. Delete the default copy constructor and default operator= (maybe also their move semantics counterpart)
  2. Implement proper constructors/operators which copy the pointer correctly
  3. Use smart pointers from the C++ std lib (though I am not sure this is a dependency Arduino Core wants to have?)
  4. Re-introduce the String object which I used in the orignal commit of that PR

I am in favor of 4. Please let me know which solution you prefer and I can create a PR for this.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Status: StaleIssue is stale stage (outdated/stuck)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions