vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

calloc: Use calloc() at most places

Browse source 
This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones 2020-06-15 12:26:01 -04:00 • committed by Daniel Kiper
parent 64e26162eb
commit f725fa7cb2
87 changed files with 179 additions and 178 deletions
Download patch file Download diff file Expand all files Collapse all files

10
grub-core/net/dns.c
View file

@ -285,8 +285,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
ptr++;
ptr += 4;
}
*data->addresses = grub_malloc (sizeof ((*data->addresses)[0])
* grub_be_to_cpu16 (head->ancount));
*data->addresses = grub_calloc (grub_be_to_cpu16 (head->ancount),
sizeof ((*data->addresses)[0]));
if (!*data->addresses)
{
grub_errno = GRUB_ERR_NONE;
@ -406,8 +406,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
dns_cache[h].addresses = 0;
dns_cache[h].name = grub_strdup (data->oname);
dns_cache[h].naddresses = *data->naddresses;
dns_cache[h].addresses = grub_malloc (*data->naddresses
* sizeof (dns_cache[h].addresses[0]));
dns_cache[h].addresses = grub_calloc (*data->naddresses,
sizeof (dns_cache[h].addresses[0]));
dns_cache[h].limit_time = grub_get_time_ms () + 1000 * ttl_all;
if (!dns_cache[h].addresses || !dns_cache[h].name)
{
@ -479,7 +479,7 @@ grub_net_dns_lookup (const char *name,
}
}
sockets = grub_malloc (sizeof (sockets[0]) * n_servers);
sockets = grub_calloc (n_servers, sizeof (sockets[0]));
if (!sockets)
return grub_errno;