Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-23 15:49:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

calloc: Use calloc() at most places

Browse Source 
This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Peter Jones authored and Daniel Kiper committed 2020-07-29 16:55:47 +02:00
1 parent 64e26162eb
commit f725fa7cb2
87 files changed
+179 -178
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/fs/hfsplus.c
+3 -3
View File
@@ -720,7 +720,7 @@ list_nodes (void *record, void *hook_arg)
if (! filename)
return 0;
keyname = grub_malloc (grub_be_to_cpu16 (catkey->namelen) * sizeof (*keyname));
keyname = grub_calloc (grub_be_to_cpu16 (catkey->namelen), sizeof (*keyname));
if (!keyname)
{
grub_free (filename);
@@ -1007,7 +1007,7 @@ grub_hfsplus_label (grub_device_t device, char **label)
grub_hfsplus_btree_recptr (&data->catalog_tree, node, ptr);
label_len = grub_be_to_cpu16 (catkey->namelen);
label_name = grub_malloc (label_len * sizeof (*label_name));
label_name = grub_calloc (label_len, sizeof (*label_name));
if (!label_name)
{
grub_free (node);
@@ -1029,7 +1029,7 @@ grub_hfsplus_label (grub_device_t device, char **label)
}
}
*label = grub_malloc (label_len * GRUB_MAX_UTF8_PER_UTF16 + 1);
*label = grub_calloc (label_len, GRUB_MAX_UTF8_PER_UTF16 + 1);
if (! *label)
{
grub_free (label_name);