Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-20 22:48:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initialized initrd_ctx so we don't free a random pointer from the stack.

Browse Source 
Currently, if "linux" fails, the "goto fail;" in grub_cmd_initrd sends us
into grub_initrd_close() without grub_initrd_init() being called, and thus
it never clears initrd_ctx->components.  grub_initrd_close() then frees that
address, which is stale data from the stack.  If the stack happens to have a
stale *address* there that matches a recent allocation, then you'll get a
double free later.

So initialize the memory up front.

Signed-off-by: Peter Jones <pjones@redhat.com>
This commit is contained in:
Peter Jones authored and Andrei Borzenkov committed 2014-09-21 10:36:42 +04:00
1 parent 60049a0e72
commit 631a820038
9 files changed
+20 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/loader/arm/linux.c
+1 -1
View File
@@ -396,7 +396,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
{
grub_file_t file;
grub_size_t size = 0;
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
if (argc == 0)
return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
grub-core/loader/arm64/linux.c
+1 -1
View File
@@ -328,7 +328,7 @@ static grub_err_t
grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
int argc, char *argv[])
{
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
int initrd_size, initrd_pages;
void *initrd_mem = NULL;
grub-core/loader/i386/linux.c
+1 -1
View File
@@ -1050,7 +1050,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
grub_addr_t addr_min, addr_max;
grub_addr_t addr;
grub_err_t err;
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
if (argc == 0)
{
grub-core/loader/i386/pc/linux.c
+1 -1
View File
@@ -388,7 +388,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
grub_uint8_t *initrd_chunk;
grub_addr_t initrd_addr;
grub_err_t err;
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
if (argc == 0)
{
grub-core/loader/ia64/efi/linux.c
+1 -1
View File
@@ -568,7 +568,7 @@ static grub_err_t
grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
int argc, char *argv[])
{
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
if (argc == 0)
{
grub-core/loader/mips/linux.c
+1 -1
View File
@@ -415,7 +415,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
void *initrd_src;
grub_addr_t initrd_dest;
grub_err_t err;
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
if (argc == 0)
return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
grub-core/loader/powerpc/ieee1275/linux.c
+1 -1
View File
@@ -333,7 +333,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
grub_size_t size = 0;
grub_addr_t first_addr;
grub_addr_t addr;
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
if (argc == 0)
{
grub-core/loader/sparc64/ieee1275/linux.c
+1 -1
View File
@@ -373,7 +373,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
grub_addr_t paddr;
grub_addr_t addr;
int ret;
struct grub_linux_initrd_context initrd_ctx;
struct grub_linux_initrd_context initrd_ctx = { 0, };
if (argc == 0)
{