From 14d891dd3e596880468b6d6437f198ed0af59828 Mon Sep 17 00:00:00 2001 From: Archit Gupta Date: Fri, 5 Jul 2024 16:14:29 -0700 Subject: [PATCH] Add missing error check In FF_Write a loop is used to write remaining blocks, and breaks are used to terminate on error. However, these breaks intended to break the containing do-while. As they do not, on error from FF_BlockWrite, control would get passed to after the loop, FF_SetCluster would clear the error, and FF_WritePartial would be called with ulBytesLeft greater than block size, which is invalid and causes out of bounds memory writes. This is fixed by checking the error after the loop and breaking again. --- ff_file.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ff_file.c b/ff_file.c index 87bb31e..fbae1da 100644 --- a/ff_file.c +++ b/ff_file.c @@ -2447,6 +2447,11 @@ int32_t FF_Write( FF_FILE * pxFile, } } + if( FF_isERR( xError ) ) + { + break; + } + /*---------- Write (memcpy) Remaining Bytes */ if( ulBytesLeft == 0 ) {