### 漏洞概述 - **CVE编号**: CVE-2026-30363 - **漏洞类型**: 潜在栈溢出 - **描述**: 在 `main` 函数中存在潜在的栈溢出漏洞，原因是栈分配不足。`main` 函数被创建时固定栈大小为 1024 字节，但静态栈使用分析表明，最坏情况下的调用链可能需要约 1464 字节的栈空间。这种分配与需求之间的不匹配可能导致执行期间的潜在栈溢出条件。 ### 影响范围 - **受影响版本**: flipperzero-firmware (commit ad2a890 及可能更早的版本) - **潜在影响**: - 系统崩溃 - 未定义行为 ### 修复方案 - **验证步骤**: 1. 启用栈使用分析： - 添加 `-fstack-usage` 到编译器标志 2. 构建项目 3. 检查生成的 `.su` 文件 4. 观察 `main` 调用链是否超过分配的栈大小 ### 参考链接 - [GitHub Issue](https://github.com/flipperdevices/flipperzero-firmware/issues/4332) ### 代码块 ```plaintext # CVE-2026-30363: Potential Stack Overflow in main (flipperzero-firmware) ## Summary A potential stack overflow vulnerability exists in the main function due to insufficient stack allocation. ## Affected Versions - flipperzero-firmware (commit ad2a890 and possibly earlier versions) ## Description The main function is created with a fixed stack size of 1024 bytes: ```_stack_size = 0x400; // required amount of stack */ However, static stack usage analysis indicates that the worst-case call chain may require approximately 1464 bytes of stack space. This mismatch between allocated and required stack size may lead to a potential stack overflow condition during execution. ## Impact This issue may lead to: - System crash - Undefined behavior ## Proof of Concept 1. Enable stack usage analysis: - Add `-fstack-usage` to compiler flags 2. Build the project 3. Inspect generated `.su` files 4. Observe that main call chain exceeds allocated stack size ## References - https://github.com/flipperdevices/flipperzero-firmware/issues/4332 ```