vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

calloc: Use calloc() at most places

Browse source 
This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones 2020-06-15 12:26:01 -04:00 • committed by Daniel Kiper
parent 64e26162eb
commit f725fa7cb2
87 changed files with 179 additions and 178 deletions
Download patch file Download diff file Expand all files Collapse all files

12
grub-core/disk/lvm.c
View file

@ -210,7 +210,7 @@ grub_lvm_detect (grub_disk_t disk,
first one. */
/* Allocate buffer space for the circular worst-case scenario. */
metadatabuf = grub_malloc (2 * mda_size);
metadatabuf = grub_calloc (2, mda_size);
if (! metadatabuf)
goto fail;
@ -465,7 +465,7 @@ grub_lvm_detect (grub_disk_t disk,
#endif
goto lvs_fail;
}
lv->segments = grub_zalloc (sizeof (*seg) * lv->segment_count);
lv->segments = grub_calloc (lv->segment_count, sizeof (*seg));
seg = lv->segments;
for (i = 0; i < lv->segment_count; i++)
@ -522,8 +522,8 @@ grub_lvm_detect (grub_disk_t disk,
if (seg->node_count != 1)
seg->stripe_size = grub_lvm_getvalue (&p, "stripe_size = ");
seg->nodes = grub_zalloc (sizeof (*stripe)
* seg->node_count);
seg->nodes = grub_calloc (seg->node_count,
sizeof (*stripe));
stripe = seg->nodes;
p = grub_strstr (p, "stripes = [");
@ -899,7 +899,7 @@ grub_lvm_detect (grub_disk_t disk,
break;
if (lv)
{
cache->lv->segments = grub_malloc (lv->segment_count * sizeof (*lv->segments));
cache->lv->segments = grub_calloc (lv->segment_count, sizeof (*lv->segments));
if (!cache->lv->segments)
{
grub_lvm_free_cache_lvs (cache_lvs);
@ -912,7 +912,7 @@ grub_lvm_detect (grub_disk_t disk,
struct grub_diskfilter_node *nodes = lv->segments[i].nodes;
grub_size_t node_count = lv->segments[i].node_count;
cache->lv->segments[i].nodes = grub_malloc (node_count * sizeof (*nodes));
cache->lv->segments[i].nodes = grub_calloc (node_count, sizeof (*nodes));
if (!cache->lv->segments[i].nodes)
{
for (j = 0; j < i; ++j)