vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

calloc: Use calloc() at most places

Browse source 
This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones 2020-06-15 12:26:01 -04:00 • committed by Daniel Kiper
parent 64e26162eb
commit f725fa7cb2
87 changed files with 179 additions and 178 deletions
Download patch file Download diff file Expand all files Collapse all files

6
grub-core/fs/affs.c
View file

@ -301,7 +301,7 @@ grub_affs_read_symlink (grub_fshelp_node_t node)
return 0;
}
latin1[symlink_size] = 0;
utf8 = grub_malloc (symlink_size * GRUB_MAX_UTF8_PER_LATIN1 + 1);
utf8 = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, symlink_size);
if (!utf8)
{
grub_free (latin1);
@ -422,7 +422,7 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir,
return 1;
}
hashtable = grub_zalloc (data->htsize * sizeof (*hashtable));
hashtable = grub_calloc (data->htsize, sizeof (*hashtable));
if (!hashtable)
return 1;
@ -628,7 +628,7 @@ grub_affs_label (grub_device_t device, char **label)
len = file.namelen;
if (len > sizeof (file.name))
len = sizeof (file.name);
*label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);
*label = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, len);
if (*label)
*grub_latin1_to_utf8 ((grub_uint8_t *) *label, file.name, len) = '\0';
}