Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-26 00:59:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

calloc: Use calloc() at most places

Browse Source 
This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones authored and Daniel Kiper committed 2020-07-29 16:55:47 +02:00
1 parent 64e26162eb
commit f725fa7cb2
87 files changed
+179 -178
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/disk/lvm.c
+6 -6
View File
@@ -210,7 +210,7 @@ grub_lvm_detect (grub_disk_t disk,
first one. */
/* Allocate buffer space for the circular worst-case scenario. */
metadatabuf = grub_malloc (2 * mda_size);
metadatabuf = grub_calloc (2, mda_size);
if (! metadatabuf)
goto fail;
@@ -465,7 +465,7 @@ grub_lvm_detect (grub_disk_t disk,
#endif
goto lvs_fail;
}
lv->segments = grub_zalloc (sizeof (*seg) * lv->segment_count);
lv->segments = grub_calloc (lv->segment_count, sizeof (*seg));
seg = lv->segments;
for (i = 0; i < lv->segment_count; i++)
@@ -522,8 +522,8 @@ grub_lvm_detect (grub_disk_t disk,
if (seg->node_count != 1)
seg->stripe_size = grub_lvm_getvalue (&p, "stripe_size = ");
seg->nodes = grub_zalloc (sizeof (*stripe)
* seg->node_count);
seg->nodes = grub_calloc (seg->node_count,
sizeof (*stripe));
stripe = seg->nodes;
p = grub_strstr (p, "stripes = [");
@@ -899,7 +899,7 @@ grub_lvm_detect (grub_disk_t disk,
break;
if (lv)
{
cache->lv->segments = grub_malloc (lv->segment_count * sizeof (*lv->segments));
cache->lv->segments = grub_calloc (lv->segment_count, sizeof (*lv->segments));
if (!cache->lv->segments)
{
grub_lvm_free_cache_lvs (cache_lvs);
@@ -912,7 +912,7 @@ grub_lvm_detect (grub_disk_t disk,
struct grub_diskfilter_node *nodes = lv->segments[i].nodes;
grub_size_t node_count = lv->segments[i].node_count;
cache->lv->segments[i].nodes = grub_malloc (node_count * sizeof (*nodes));
cache->lv->segments[i].nodes = grub_calloc (node_count, sizeof (*nodes));
if (!cache->lv->segments[i].nodes)
{
for (j = 0; j < i; ++j)