calloc: Use calloc() at most places

This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

grub-core/lib/json/json.c

@@ -53,7 +53,7 @@ grub_json_parse (grub_json_t **out, char *string, grub_size_t string_len)
       goto err;
     }
 
-  json->tokens = grub_malloc (sizeof (jsmntok_t) * jsmn_ret);
+  json->tokens = grub_calloc (jsmn_ret, sizeof (jsmntok_t));
   if (!json->tokens)
     {
       ret = GRUB_ERR_OUT_OF_MEMORY;

grub-core/lib/libgcrypt/cipher/ac.c

@@ -185,7 +185,7 @@ ac_data_mpi_copy (gcry_ac_mpi_t *data_mpis, unsigned int data_mpis_n,
   gcry_mpi_t mpi;
   char *label;
 
-  data_mpis_new = gcry_malloc (sizeof (*data_mpis_new) * data_mpis_n);
+  data_mpis_new = gcry_calloc (data_mpis_n, sizeof (*data_mpis_new));
   if (! data_mpis_new)
     {
       err = gcry_error_from_errno (errno);
@@ -572,7 +572,7 @@ _gcry_ac_data_to_sexp (gcry_ac_data_t data, gcry_sexp_t *sexp,
     }
 
   /* Add MPI list.  */
-  arg_list = gcry_malloc (sizeof (*arg_list) * (data_n + 1));
+  arg_list = gcry_calloc (data_n + 1, sizeof (*arg_list));
   if (! arg_list)
     {
       err = gcry_error_from_errno (errno);
@@ -1283,7 +1283,7 @@ ac_data_construct (const char *identifier, int include_flags,
   /* We build a list of arguments to pass to
      gcry_sexp_build_array().  */
   data_length = _gcry_ac_data_length (data);
-  arg_list = gcry_malloc (sizeof (*arg_list) * (data_length * 2));
+  arg_list = gcry_calloc (data_length, sizeof (*arg_list) * 2);
   if (! arg_list)
     {
       err = gcry_error_from_errno (errno);
@@ -1593,7 +1593,7 @@ _gcry_ac_key_pair_generate (gcry_ac_handle_t handle, unsigned int nbits,
 	arg_list_n += 2;
 
   /* Allocate list.  */
-  arg_list = gcry_malloc (sizeof (*arg_list) * arg_list_n);
+  arg_list = gcry_calloc (arg_list_n, sizeof (*arg_list));
   if (! arg_list)
     {
       err = gcry_error_from_errno (errno);

grub-core/lib/libgcrypt/cipher/primegen.c

@@ -383,7 +383,7 @@ prime_generate_internal (int need_q_factor,
     }
 
   /* Allocate an array to track pool usage. */
-  pool_in_use = gcry_malloc (n * sizeof *pool_in_use);
+  pool_in_use = gcry_calloc (n, sizeof *pool_in_use);
   if (!pool_in_use)
     {
       err = gpg_err_code_from_errno (errno);
@@ -765,7 +765,7 @@ gen_prime (unsigned int nbits, int secret, int randomlevel,
   if (nbits < 16)
     log_fatal ("can't generate a prime with less than %d bits\n", 16);
 
-  mods = gcry_xmalloc( no_of_small_prime_numbers * sizeof *mods );
+  mods = gcry_xcalloc( no_of_small_prime_numbers, sizeof *mods);
   /* Make nbits fit into gcry_mpi_t implementation. */
   val_2  = mpi_alloc_set_ui( 2 );
   val_3 = mpi_alloc_set_ui( 3);

grub-core/lib/libgcrypt/cipher/pubkey.c

@@ -2941,7 +2941,7 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gcry_sexp_t s_data, gcry_sexp_t s_pkey)
        * array to a format string, so we have to do it this way :-(.  */
       /* FIXME: There is now such a format specifier, so we can
          change the code to be more clear. */
-      arg_list = malloc (nelem * sizeof *arg_list);
+      arg_list = calloc (nelem, sizeof *arg_list);
       if (!arg_list)
         {
           rc = gpg_err_code_from_syserror ();
@@ -3233,7 +3233,7 @@ gcry_pk_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_hash, gcry_sexp_t s_skey)
         }
       strcpy (p, "))");
 
-      arg_list = malloc (nelem * sizeof *arg_list);
+      arg_list = calloc (nelem, sizeof *arg_list);
       if (!arg_list)
         {
           rc = gpg_err_code_from_syserror ();

grub-core/lib/priority_queue.c

@@ -92,7 +92,7 @@ grub_priority_queue_new (grub_size_t elsize,
 {
   struct grub_priority_queue *ret;
   void *els;
-  els = grub_malloc (elsize * 8);
+  els = grub_calloc (8, elsize);
   if (!els)
     return 0;
   ret = (struct grub_priority_queue *) grub_malloc (sizeof (*ret));

grub-core/lib/reed_solomon.c

@@ -20,6 +20,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#define xcalloc calloc
 #define xmalloc malloc
 #define grub_memset memset
 #define grub_memcpy memcpy
@@ -158,11 +159,9 @@ rs_encode (gf_single_t *data, grub_size_t s, grub_size_t rs)
   gf_single_t *rs_polynomial;
   int i, j;
   gf_single_t *m;
-  m = xmalloc ((s + rs) * sizeof (gf_single_t));
+  m = xcalloc (s + rs, sizeof (gf_single_t));
   grub_memcpy (m, data, s * sizeof (gf_single_t));
-  grub_memset (m + s, 0, rs * sizeof (gf_single_t));
-  rs_polynomial = xmalloc ((rs + 1) * sizeof (gf_single_t));
-  grub_memset (rs_polynomial, 0, (rs + 1) * sizeof (gf_single_t));
+  rs_polynomial = xcalloc (rs + 1, sizeof (gf_single_t));
   rs_polynomial[rs] = 1;
   /* Multiply with X - a^r */
   for (j = 0; j < rs; j++)

grub-core/lib/relocator.c

@@ -495,9 +495,9 @@ malloc_in_range (struct grub_relocator *rel,
   }
 #endif
 
-  eventt = grub_malloc (maxevents * sizeof (events[0]));
+  eventt = grub_calloc (maxevents, sizeof (events[0]));
   counter = grub_malloc ((DIGITSORT_MASK + 2) * sizeof (counter[0]));
-  events = grub_malloc (maxevents * sizeof (events[0]));
+  events = grub_calloc (maxevents, sizeof (events[0]));
   if (!events || !eventt || !counter)
     {
       grub_dprintf ("relocator", "events or counter allocation failed %d\n",
@@ -963,7 +963,7 @@ malloc_in_range (struct grub_relocator *rel,
 #endif
     unsigned cural = 0;
     int oom = 0;
-    res->subchunks = grub_malloc (sizeof (res->subchunks[0]) * nallocs);
+    res->subchunks = grub_calloc (nallocs, sizeof (res->subchunks[0]));
     if (!res->subchunks)
       oom = 1;
     res->nsubchunks = nallocs;
@@ -1562,8 +1562,8 @@ grub_relocator_prepare_relocs (struct grub_relocator *rel, grub_addr_t addr,
 	    count[(chunk->src & 0xff) + 1]++;
 	  }
     }
-    from = grub_malloc (nchunks * sizeof (sorted[0]));
-    to = grub_malloc (nchunks * sizeof (sorted[0]));
+    from = grub_calloc (nchunks, sizeof (sorted[0]));
+    to = grub_calloc (nchunks, sizeof (sorted[0]));
     if (!from || !to)
       {
 	grub_free (from);

grub-core/lib/zstd/fse_decompress.c

@@ -82,7 +82,7 @@
 FSE_DTable* FSE_createDTable (unsigned tableLog)
 {
     if (tableLog > FSE_TABLELOG_ABSOLUTE_MAX) tableLog = FSE_TABLELOG_ABSOLUTE_MAX;
-    return (FSE_DTable*)malloc( FSE_DTABLE_SIZE_U32(tableLog) * sizeof (U32) );
+    return (FSE_DTable*)calloc( FSE_DTABLE_SIZE_U32(tableLog), sizeof (U32) );
 }
 
 void FSE_freeDTable (FSE_DTable* dt)