fix: at ff in ff.c

[orbisai0security]

Summary

Fix critical severity security issue in reference/drivers/fat32/source/ff.c.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	reference/drivers/fat32/source/ff.c:1691
CWE	CWE-120

Description: At ff.c:1691, the expression (DWORD)fs->csize * SS(fs) computes the allocation size szb. If fs->csize and SS(fs) are both attacker-controlled via filesystem metadata and their product exceeds UINT32_MAX (4,294,967,295), the DWORD multiplication wraps to a small value, causing ff_memalloc to allocate a much smaller buffer than intended. Subsequent writes into this undersized buffer overflow into adjacent heap memory. The overflow guard (>= MAX_MALLOC) only fires if the pre-overflow value is large enough, but the unguarded second use of fs->csize * SS(fs) in the else branch can also overflow.

Changes

• reference/drivers/fat32/source/ff.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security