Blame SOURCES/0301-calloc-Make-sure-we-always-have-an-overflow-checking.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
c4e390
From: Peter Jones <pjones@redhat.com>
c4e390
Date: Mon, 15 Jun 2020 12:15:29 -0400
b1bcb2
Subject: [PATCH] calloc: Make sure we always have an overflow-checking
c4e390
 calloc() available
c4e390
c4e390
This tries to make sure that everywhere in this source tree, we always have
c4e390
an appropriate version of calloc() (i.e. grub_calloc(), xcalloc(), etc.)
c4e390
available, and that they all safely check for overflow and return NULL when
c4e390
it would occur.
c4e390
c4e390
Signed-off-by: Peter Jones <pjones@redhat.com>
c4e390
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
c4e390
Upstream-commit-id: 79e51ab7a9a
c4e390
---
b1bcb2
 grub-core/kern/emu/misc.c          | 12 ++++++++++++
b1bcb2
 grub-core/kern/emu/mm.c            | 10 ++++++++++
b1bcb2
 grub-core/kern/mm.c                | 40 ++++++++++++++++++++++++++++++++++++++
b1bcb2
 grub-core/lib/libgcrypt_wrap/mem.c | 11 +++++++++--
b1bcb2
 grub-core/lib/posix_wrap/stdlib.h  |  8 +++++++-
c4e390
 include/grub/emu/misc.h            |  1 +
b1bcb2
 include/grub/mm.h                  |  6 ++++++
c4e390
 7 files changed, 85 insertions(+), 3 deletions(-)
c4e390
c4e390
diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c
c4e390
index 258a5649e2d..975e4a766da 100644
c4e390
--- a/grub-core/kern/emu/misc.c
c4e390
+++ b/grub-core/kern/emu/misc.c
c4e390
@@ -83,6 +83,18 @@ grub_util_error (const char *fmt, ...)
c4e390
   exit (1);
c4e390
 }
c4e390
 
c4e390
+void *
c4e390
+xcalloc (grub_size_t nmemb, grub_size_t size)
c4e390
+{
c4e390
+  void *p;
c4e390
+
c4e390
+  p = calloc (nmemb, size);
c4e390
+  if (!p)
c4e390
+    grub_util_error ("%s", _("out of memory"));
c4e390
+
c4e390
+  return p;
c4e390
+}
c4e390
+
c4e390
 void *
c4e390
 xmalloc (grub_size_t size)
c4e390
 {
c4e390
diff --git a/grub-core/kern/emu/mm.c b/grub-core/kern/emu/mm.c
c4e390
index f262e95e388..145b01d3719 100644
c4e390
--- a/grub-core/kern/emu/mm.c
c4e390
+++ b/grub-core/kern/emu/mm.c
c4e390
@@ -25,6 +25,16 @@
c4e390
 #include <string.h>
c4e390
 #include <grub/i18n.h>
c4e390
 
c4e390
+void *
c4e390
+grub_calloc (grub_size_t nmemb, grub_size_t size)
c4e390
+{
c4e390
+  void *ret;
c4e390
+  ret = calloc (nmemb, size);
c4e390
+  if (!ret)
c4e390
+    grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
c4e390
+  return ret;
c4e390
+}
c4e390
+
c4e390
 void *
c4e390
 grub_malloc (grub_size_t size)
c4e390
 {
c4e390
diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c
c4e390
index 1c3d02388f0..a424b7d0943 100644
c4e390
--- a/grub-core/kern/mm.c
c4e390
+++ b/grub-core/kern/mm.c
c4e390
@@ -67,8 +67,10 @@
c4e390
 #include <grub/dl.h>
c4e390
 #include <grub/i18n.h>
c4e390
 #include <grub/mm_private.h>
c4e390
+#include <grub/safemath.h>
c4e390
 
c4e390
 #ifdef MM_DEBUG
c4e390
+# undef grub_calloc
c4e390
 # undef grub_malloc
c4e390
 # undef grub_zalloc
c4e390
 # undef grub_realloc
c4e390
@@ -366,6 +368,30 @@ grub_memalign (grub_size_t align, grub_size_t size)
c4e390
   return 0;
c4e390
 }
c4e390
 
c4e390
+/*
c4e390
+ * Allocate NMEMB instances of SIZE bytes and return the pointer, or error on
c4e390
+ * integer overflow.
c4e390
+ */
c4e390
+void *
c4e390
+grub_calloc (grub_size_t nmemb, grub_size_t size)
c4e390
+{
c4e390
+  void *ret;
c4e390
+  grub_size_t sz = 0;
c4e390
+
c4e390
+  if (grub_mul (nmemb, size, &sz))
c4e390
+    {
c4e390
+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
c4e390
+      return NULL;
c4e390
+    }
c4e390
+
c4e390
+  ret = grub_memalign (0, sz);
c4e390
+  if (!ret)
c4e390
+    return NULL;
c4e390
+
c4e390
+  grub_memset (ret, 0, sz);
c4e390
+  return ret;
c4e390
+}
c4e390
+
c4e390
 /* Allocate SIZE bytes and return the pointer.  */
c4e390
 void *
c4e390
 grub_malloc (grub_size_t size)
c4e390
@@ -552,6 +578,20 @@ grub_mm_dump (unsigned lineno)
c4e390
   grub_printf ("\n");
c4e390
 }
c4e390
 
c4e390
+void *
c4e390
+grub_debug_calloc (const char *file, int line, grub_size_t nmemb, grub_size_t size)
c4e390
+{
c4e390
+  void *ptr;
c4e390
+
c4e390
+  if (grub_mm_debug)
c4e390
+    grub_printf ("%s:%d: calloc (0x%" PRIxGRUB_SIZE ", 0x%" PRIxGRUB_SIZE ") = ",
c4e390
+		 file, line, size);
c4e390
+  ptr = grub_calloc (nmemb, size);
c4e390
+  if (grub_mm_debug)
c4e390
+    grub_printf ("%p\n", ptr);
c4e390
+  return ptr;
c4e390
+}
c4e390
+
c4e390
 void *
c4e390
 grub_debug_malloc (const char *file, int line, grub_size_t size)
c4e390
 {
c4e390
diff --git a/grub-core/lib/libgcrypt_wrap/mem.c b/grub-core/lib/libgcrypt_wrap/mem.c
c4e390
index beeb661a3c8..74c6eafe525 100644
c4e390
--- a/grub-core/lib/libgcrypt_wrap/mem.c
c4e390
+++ b/grub-core/lib/libgcrypt_wrap/mem.c
c4e390
@@ -4,6 +4,7 @@
c4e390
 #include <grub/crypto.h>
c4e390
 #include <grub/dl.h>
c4e390
 #include <grub/env.h>
c4e390
+#include <grub/safemath.h>
c4e390
 
c4e390
 GRUB_MOD_LICENSE ("GPLv3+");
c4e390
 
c4e390
@@ -36,7 +37,10 @@ void *
c4e390
 gcry_xcalloc (size_t n, size_t m)
c4e390
 {
c4e390
   void *ret;
c4e390
-  ret = grub_zalloc (n * m);
c4e390
+  size_t sz;
c4e390
+  if (grub_mul (n, m, &sz))
c4e390
+    grub_fatal ("gcry_xcalloc would overflow");
c4e390
+  ret = grub_zalloc (sz);
c4e390
   if (!ret)
c4e390
     grub_fatal ("gcry_xcalloc failed");
c4e390
   return ret;
c4e390
@@ -56,7 +60,10 @@ void *
c4e390
 gcry_xcalloc_secure (size_t n, size_t m)
c4e390
 {
c4e390
   void *ret;
c4e390
-  ret = grub_zalloc (n * m);
c4e390
+  size_t sz;
c4e390
+  if (grub_mul (n, m, &sz))
c4e390
+    grub_fatal ("gcry_xcalloc would overflow");
c4e390
+  ret = grub_zalloc (sz);
c4e390
   if (!ret)
c4e390
     grub_fatal ("gcry_xcalloc failed");
c4e390
   return ret;
c4e390
diff --git a/grub-core/lib/posix_wrap/stdlib.h b/grub-core/lib/posix_wrap/stdlib.h
c4e390
index 3b46f47ff50..7a8d385e973 100644
c4e390
--- a/grub-core/lib/posix_wrap/stdlib.h
c4e390
+++ b/grub-core/lib/posix_wrap/stdlib.h
c4e390
@@ -21,6 +21,7 @@
c4e390
 
c4e390
 #include <grub/mm.h>
c4e390
 #include <grub/misc.h>
c4e390
+#include <grub/safemath.h>
c4e390
 
c4e390
 static inline void 
c4e390
 free (void *ptr)
c4e390
@@ -37,7 +38,12 @@ malloc (grub_size_t size)
c4e390
 static inline void *
c4e390
 calloc (grub_size_t size, grub_size_t nelem)
c4e390
 {
c4e390
-  return grub_zalloc (size * nelem);
c4e390
+  grub_size_t sz;
c4e390
+
c4e390
+  if (grub_mul (size, nelem, &sz))
c4e390
+    return NULL;
c4e390
+
c4e390
+  return grub_zalloc (sz);
c4e390
 }
c4e390
 
c4e390
 static inline void *
c4e390
diff --git a/include/grub/emu/misc.h b/include/grub/emu/misc.h
c4e390
index a588ba21da2..9e0e793d3df 100644
c4e390
--- a/include/grub/emu/misc.h
c4e390
+++ b/include/grub/emu/misc.h
c4e390
@@ -50,6 +50,7 @@ grub_util_device_is_mapped (const char *dev);
c4e390
 #define GRUB_HOST_PRIxLONG_LONG "llx"
c4e390
 #endif
c4e390
 
c4e390
+void * EXPORT_FUNC(xcalloc) (grub_size_t nmemb, grub_size_t size) WARN_UNUSED_RESULT;
c4e390
 void * EXPORT_FUNC(xmalloc) (grub_size_t size) WARN_UNUSED_RESULT;
c4e390
 void * EXPORT_FUNC(xrealloc) (void *ptr, grub_size_t size) WARN_UNUSED_RESULT;
c4e390
 char * EXPORT_FUNC(xstrdup) (const char *str) WARN_UNUSED_RESULT;
c4e390
diff --git a/include/grub/mm.h b/include/grub/mm.h
c4e390
index 28e2e53eb32..9c38dd3ca5d 100644
c4e390
--- a/include/grub/mm.h
c4e390
+++ b/include/grub/mm.h
c4e390
@@ -29,6 +29,7 @@
c4e390
 #endif
c4e390
 
c4e390
 void grub_mm_init_region (void *addr, grub_size_t size);
c4e390
+void *EXPORT_FUNC(grub_calloc) (grub_size_t nmemb, grub_size_t size);
c4e390
 void *EXPORT_FUNC(grub_malloc) (grub_size_t size);
c4e390
 void *EXPORT_FUNC(grub_zalloc) (grub_size_t size);
c4e390
 void EXPORT_FUNC(grub_free) (void *ptr);
c4e390
@@ -48,6 +49,9 @@ extern int EXPORT_VAR(grub_mm_debug);
c4e390
 void grub_mm_dump_free (void);
c4e390
 void grub_mm_dump (unsigned lineno);
c4e390
 
c4e390
+#define grub_calloc(nmemb, size)	\
c4e390
+  grub_debug_calloc (GRUB_FILE, __LINE__, nmemb, size)
c4e390
+
c4e390
 #define grub_malloc(size)	\
c4e390
   grub_debug_malloc (GRUB_FILE, __LINE__, size)
c4e390
 
c4e390
@@ -63,6 +67,8 @@ void grub_mm_dump (unsigned lineno);
c4e390
 #define grub_free(ptr)	\
c4e390
   grub_debug_free (GRUB_FILE, __LINE__, ptr)
c4e390
 
c4e390
+void *EXPORT_FUNC(grub_debug_calloc) (const char *file, int line,
c4e390
+				      grub_size_t nmemb, grub_size_t size);
c4e390
 void *EXPORT_FUNC(grub_debug_malloc) (const char *file, int line,
c4e390
 				      grub_size_t size);
c4e390
 void *EXPORT_FUNC(grub_debug_zalloc) (const char *file, int line,