vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

calloc: Use calloc() at most places

Browse source 
This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones 2020-06-15 12:26:01 -04:00 • committed by Daniel Kiper
parent 64e26162eb
commit f725fa7cb2
87 changed files with 179 additions and 178 deletions
Download patch file Download diff file Expand all files Collapse all files

14
grub-core/disk/ldm.c
View file

@ -323,8 +323,8 @@ make_vg (grub_disk_t disk,
lv->segments->type = GRUB_DISKFILTER_MIRROR;
lv->segments->node_count = 0;
lv->segments->node_alloc = 8;
lv->segments->nodes = grub_zalloc (sizeof (*lv->segments->nodes)
* lv->segments->node_alloc);
lv->segments->nodes = grub_calloc (lv->segments->node_alloc,
sizeof (*lv->segments->nodes));
if (!lv->segments->nodes)
goto fail2;
ptr = vblk[i].dynamic;
@ -543,8 +543,8 @@ make_vg (grub_disk_t disk,
{
comp->segment_alloc = 8;
comp->segment_count = 0;
comp->segments = grub_malloc (sizeof (*comp->segments)
* comp->segment_alloc);
comp->segments = grub_calloc (comp->segment_alloc,
sizeof (*comp->segments));
if (!comp->segments)
goto fail2;
}
@ -590,8 +590,8 @@ make_vg (grub_disk_t disk,
}
comp->segments->node_count = read_int (ptr + 1, *ptr);
comp->segments->node_alloc = comp->segments->node_count;
comp->segments->nodes = grub_zalloc (sizeof (*comp->segments->nodes)
* comp->segments->node_alloc);
comp->segments->nodes = grub_calloc (comp->segments->node_alloc,
sizeof (*comp->segments->nodes));
if (!lv->segments->nodes)
goto fail2;
}
@ -1017,7 +1017,7 @@ grub_util_ldm_embed (struct grub_disk *disk, unsigned int *nsectors,
*nsectors = lv->size;
if (*nsectors > max_nsectors)
*nsectors = max_nsectors;
*sectors = grub_malloc (*nsectors * sizeof (**sectors));
*sectors = grub_calloc (*nsectors, sizeof (**sectors));
if (!*sectors)
return grub_errno;
for (i = 0; i < *nsectors; i++)