Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-26 00:59:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs: Prevent overflows when allocating memory for arrays

Browse Source 
Use grub_calloc() when allocating memory for arrays to ensure proper
overflow checks are in place.

The HFS+ and squash4 security vulnerabilities were reported by
Jonathan Bar Or <jonathanbaror@gmail.com>.

Fixes: CVE-2025-0678
Fixes: CVE-2025-1125

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2025-02-13 15:45:57 +01:00
1 parent 6608163b08
commit 84bc0a9a68
3 files changed
+13 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/fs/btrfs.c
+2 -2
View File
@@ -1276,8 +1276,8 @@ grub_btrfs_mount (grub_device_t dev)
} }
data->n_devices_allocated = 16; data->n_devices_allocated = 16;
data->devices_attached = grub_malloc (sizeof (data->devices_attached[0]) data->devices_attached = grub_calloc (data->n_devices_allocated,
* data->n_devices_allocated); sizeof (data->devices_attached[0]));
if (!data->devices_attached) if (!data->devices_attached)
{ {
grub_free (data); grub_free (data);
grub-core/fs/hfspluscomp.c
+7 -2
View File
@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node)
return 0; return 0;
} }
node->compress_index_size = grub_le_to_cpu32 (index_size); node->compress_index_size = grub_le_to_cpu32 (index_size);
node->compress_index = grub_malloc (node->compress_index_size node->compress_index = grub_calloc (node->compress_index_size,
* sizeof (node->compress_index[0])); sizeof (node->compress_index[0]));
if (!node->compress_index) if (!node->compress_index)
{ {
node->compressed = 0; node->compressed = 0;
grub_free (attr_node); grub_free (attr_node);
return grub_errno; return grub_errno;
} }
/*
* The node->compress_index_size * sizeof (node->compress_index[0]) is safe here
* due to relevant checks done in grub_calloc() above.
*/
if (grub_hfsplus_read_file (node, 0, 0, if (grub_hfsplus_read_file (node, 0, 0,
0x104 + sizeof (index_size), 0x104 + sizeof (index_size),
node->compress_index_size node->compress_index_size
grub-core/fs/squash4.c
+4 -4
View File
@@ -822,10 +822,10 @@ direct_read (struct grub_squash_data *data,
break; break;
} }
total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz); total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz);
ino->block_sizes = grub_malloc (total_blocks ino->block_sizes = grub_calloc (total_blocks,
* sizeof (ino->block_sizes[0])); sizeof (ino->block_sizes[0]));
ino->cumulated_block_sizes = grub_malloc (total_blocks ino->cumulated_block_sizes = grub_calloc (total_blocks,
* sizeof (ino->cumulated_block_sizes[0])); sizeof (ino->cumulated_block_sizes[0]));
if (!ino->block_sizes || !ino->cumulated_block_sizes) if (!ino->block_sizes || !ino->cumulated_block_sizes)
{ {
grub_free (ino->block_sizes); grub_free (ino->block_sizes);