All of lore.kernel.org
 help / color / mirror / Atom feed
From: Daniel Kiper <daniel.kiper@oracle.com>
To: grub-devel@gnu.org
Cc: 93sam@debian.org, alexander.burmashev@oracle.com,
	amakhalov@vmware.com, chris.coulson@canonical.com,
	cjwatson@debian.org, cperry@redhat.com, darren.kenny@oracle.com,
	darren.moffat@oracle.com, dave.miner@oracle.com,
	degranit@microsoft.com, eric.snowberg@oracle.com,
	ilya.okomin@oracle.com, jan.setjeeilers@oracle.com,
	jerecox@microsoft.com, jesse@eclypsium.com,
	john.haxby@oracle.com, kanth.ghatraju@oracle.com,
	konrad.wilk@oracle.com, mbenatto@redhat.com,
	mickey@eclypsium.com, msrc57813grub@microsoft.com,
	phcoder@gmail.com, pjones@redhat.com, sajacobu@microsoft.com,
	todd.vierling@oracle.com, xnox@ubuntu.com
Subject: [SECURITY PATCH 04/28] calloc: Use calloc() at most places
Date: Wed, 29 Jul 2020 19:00:17 +0200	[thread overview]
Message-ID: <20200729170041.14082-5-daniel.kiper@oracle.com> (raw)
In-Reply-To: <20200729170041.14082-1-daniel.kiper@oracle.com>

From: Peter Jones <pjones@redhat.com>

This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:
  - allocation of integer overflow in grub_png_decode_image_header()
    reported by Chris Coulson,
  - allocation of integer overflow in luks_recover_key()
    reported by Chris Coulson,
  - allocation of integer overflow in grub_lvm_detect()
    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/bus/usb/usbhub.c                |  8 ++++----
 grub-core/commands/efi/lsefisystab.c      |  3 ++-
 grub-core/commands/legacycfg.c            |  6 +++---
 grub-core/commands/menuentry.c            |  2 +-
 grub-core/commands/nativedisk.c           |  2 +-
 grub-core/commands/parttool.c             | 12 +++++++++---
 grub-core/commands/regexp.c               |  2 +-
 grub-core/commands/search_wrap.c          |  2 +-
 grub-core/disk/diskfilter.c               |  4 ++--
 grub-core/disk/ieee1275/ofdisk.c          |  2 +-
 grub-core/disk/ldm.c                      | 14 +++++++-------
 grub-core/disk/luks.c                     |  2 +-
 grub-core/disk/lvm.c                      | 12 ++++++------
 grub-core/disk/xen/xendisk.c              |  2 +-
 grub-core/efiemu/loadcore.c               |  2 +-
 grub-core/efiemu/mm.c                     |  6 +++---
 grub-core/font/font.c                     |  3 +--
 grub-core/fs/affs.c                       |  6 +++---
 grub-core/fs/btrfs.c                      |  6 +++---
 grub-core/fs/hfs.c                        |  2 +-
 grub-core/fs/hfsplus.c                    |  6 +++---
 grub-core/fs/iso9660.c                    |  2 +-
 grub-core/fs/ntfs.c                       |  4 ++--
 grub-core/fs/sfs.c                        |  2 +-
 grub-core/fs/tar.c                        |  2 +-
 grub-core/fs/udf.c                        |  4 ++--
 grub-core/fs/zfs/zfs.c                    |  4 ++--
 grub-core/gfxmenu/gui_string_util.c       |  2 +-
 grub-core/gfxmenu/widget-box.c            |  4 ++--
 grub-core/io/gzio.c                       |  2 +-
 grub-core/kern/efi/efi.c                  |  6 +++---
 grub-core/kern/emu/hostdisk.c             |  2 +-
 grub-core/kern/fs.c                       |  2 +-
 grub-core/kern/misc.c                     |  2 +-
 grub-core/kern/parser.c                   |  2 +-
 grub-core/kern/uboot/uboot.c              |  2 +-
 grub-core/lib/json/json.c                 |  2 +-
 grub-core/lib/libgcrypt/cipher/ac.c       |  8 ++++----
 grub-core/lib/libgcrypt/cipher/primegen.c |  4 ++--
 grub-core/lib/libgcrypt/cipher/pubkey.c   |  4 ++--
 grub-core/lib/priority_queue.c            |  2 +-
 grub-core/lib/reed_solomon.c              |  7 +++----
 grub-core/lib/relocator.c                 | 10 +++++-----
 grub-core/lib/zstd/fse_decompress.c       |  2 +-
 grub-core/loader/arm/linux.c              |  2 +-
 grub-core/loader/efi/chainloader.c        |  2 +-
 grub-core/loader/i386/bsdXX.c             |  2 +-
 grub-core/loader/i386/xnu.c               |  4 ++--
 grub-core/loader/macho.c                  |  2 +-
 grub-core/loader/multiboot_elfxx.c        |  2 +-
 grub-core/loader/xnu.c                    |  2 +-
 grub-core/mmap/mmap.c                     |  4 ++--
 grub-core/net/bootp.c                     |  2 +-
 grub-core/net/dns.c                       | 10 +++++-----
 grub-core/net/net.c                       |  4 ++--
 grub-core/normal/charset.c                | 10 +++++-----
 grub-core/normal/cmdline.c                | 14 +++++++-------
 grub-core/normal/menu_entry.c             | 14 +++++++-------
 grub-core/normal/menu_text.c              |  4 ++--
 grub-core/normal/term.c                   |  4 ++--
 grub-core/osdep/linux/getroot.c           |  6 +++---
 grub-core/osdep/unix/config.c             |  2 +-
 grub-core/osdep/windows/getroot.c         |  2 +-
 grub-core/osdep/windows/hostdisk.c        |  4 ++--
 grub-core/osdep/windows/init.c            |  2 +-
 grub-core/osdep/windows/platform.c        |  4 ++--
 grub-core/osdep/windows/relpath.c         |  2 +-
 grub-core/partmap/gpt.c                   |  2 +-
 grub-core/partmap/msdos.c                 |  2 +-
 grub-core/script/execute.c                |  2 +-
 grub-core/tests/fake_input.c              |  2 +-
 grub-core/tests/video_checksum.c          |  6 +++---
 grub-core/video/capture.c                 |  2 +-
 grub-core/video/emu/sdl.c                 |  2 +-
 grub-core/video/i386/pc/vga.c             |  2 +-
 grub-core/video/readers/png.c             |  2 +-
 include/grub/unicode.h                    |  4 ++--
 util/getroot.c                            |  2 +-
 util/grub-file.c                          |  2 +-
 util/grub-fstest.c                        |  4 ++--
 util/grub-install-common.c                |  2 +-
 util/grub-install.c                       |  4 ++--
 util/grub-mkimagexx.c                     |  6 ++----
 util/grub-mkrescue.c                      |  4 ++--
 util/grub-mkstandalone.c                  |  2 +-
 util/grub-pe2elf.c                        | 12 +++++-------
 util/grub-probe.c                         |  4 ++--
 87 files changed, 179 insertions(+), 178 deletions(-)

diff --git a/grub-core/bus/usb/usbhub.c b/grub-core/bus/usb/usbhub.c
index 34a7ff1b5..a06cce302 100644
--- a/grub-core/bus/usb/usbhub.c
+++ b/grub-core/bus/usb/usbhub.c
@@ -149,8 +149,8 @@ grub_usb_add_hub (grub_usb_device_t dev)
   grub_usb_set_configuration (dev, 1);
 
   dev->nports = hubdesc.portcnt;
-  dev->children = grub_zalloc (hubdesc.portcnt * sizeof (dev->children[0]));
-  dev->ports = grub_zalloc (dev->nports * sizeof (dev->ports[0]));
+  dev->children = grub_calloc (hubdesc.portcnt, sizeof (dev->children[0]));
+  dev->ports = grub_calloc (dev->nports, sizeof (dev->ports[0]));
   if (!dev->children || !dev->ports)
     {
       grub_free (dev->children);
@@ -268,8 +268,8 @@ grub_usb_controller_dev_register_iter (grub_usb_controller_t controller, void *d
 
   /* Query the number of ports the root Hub has.  */
   hub->nports = controller->dev->hubports (controller);
-  hub->devices = grub_zalloc (sizeof (hub->devices[0]) * hub->nports);
-  hub->ports = grub_zalloc (sizeof (hub->ports[0]) * hub->nports);
+  hub->devices = grub_calloc (hub->nports, sizeof (hub->devices[0]));
+  hub->ports = grub_calloc (hub->nports, sizeof (hub->ports[0]));
   if (!hub->devices || !hub->ports)
     {
       grub_free (hub->devices);
diff --git a/grub-core/commands/efi/lsefisystab.c b/grub-core/commands/efi/lsefisystab.c
index 902788250..d29188efa 100644
--- a/grub-core/commands/efi/lsefisystab.c
+++ b/grub-core/commands/efi/lsefisystab.c
@@ -73,7 +73,8 @@ grub_cmd_lsefisystab (struct grub_command *cmd __attribute__ ((unused)),
     grub_printf ("Vendor: ");
     
     for (vendor_utf16 = st->firmware_vendor; *vendor_utf16; vendor_utf16++);
-    vendor = grub_malloc (4 * (vendor_utf16 - st->firmware_vendor) + 1);
+    /* Allocate extra 3 bytes to simplify math. */
+    vendor = grub_calloc (4, vendor_utf16 - st->firmware_vendor + 1);
     if (!vendor)
       return grub_errno;
     *grub_utf16_to_utf8 ((grub_uint8_t *) vendor, st->firmware_vendor,
diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
index db7a8f002..5e3ec0d5e 100644
--- a/grub-core/commands/legacycfg.c
+++ b/grub-core/commands/legacycfg.c
@@ -314,7 +314,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)),
   if (argc < 2)
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
 
-  cutargs = grub_malloc (sizeof (cutargs[0]) * (argc - 1));
+  cutargs = grub_calloc (argc - 1, sizeof (cutargs[0]));
   if (!cutargs)
     return grub_errno;
   cutargc = argc - 1;
@@ -436,7 +436,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)),
 	    {
 	      char rbuf[3] = "-r";
 	      bsdargc = cutargc + 2;
-	      bsdargs = grub_malloc (sizeof (bsdargs[0]) * bsdargc);
+	      bsdargs = grub_calloc (bsdargc, sizeof (bsdargs[0]));
 	      if (!bsdargs)
 		{
 		  err = grub_errno;
@@ -559,7 +559,7 @@ grub_cmd_legacy_initrdnounzip (struct grub_command *mycmd __attribute__ ((unused
 	return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("can't find command `%s'"),
 			   "module");
 
-      newargs = grub_malloc ((argc + 1) * sizeof (newargs[0]));
+      newargs = grub_calloc (argc + 1, sizeof (newargs[0]));
       if (!newargs)
 	return grub_errno;
       grub_memcpy (newargs + 1, args, argc * sizeof (newargs[0]));
diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
index 2c5363da7..9164df744 100644
--- a/grub-core/commands/menuentry.c
+++ b/grub-core/commands/menuentry.c
@@ -154,7 +154,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
     goto fail;
 
   /* Save argc, args to pass as parameters to block arg later. */
-  menu_args = grub_malloc (sizeof (char*) * (argc + 1));
+  menu_args = grub_calloc (argc + 1, sizeof (char *));
   if (! menu_args)
     goto fail;
 
diff --git a/grub-core/commands/nativedisk.c b/grub-core/commands/nativedisk.c
index 699447d11..7c8f97f6a 100644
--- a/grub-core/commands/nativedisk.c
+++ b/grub-core/commands/nativedisk.c
@@ -195,7 +195,7 @@ grub_cmd_nativedisk (grub_command_t cmd __attribute__ ((unused)),
   else
     path_prefix = prefix;
 
-  mods = grub_malloc (argc * sizeof (mods[0]));
+  mods = grub_calloc (argc, sizeof (mods[0]));
   if (!mods)
     return grub_errno;
 
diff --git a/grub-core/commands/parttool.c b/grub-core/commands/parttool.c
index 22b46b187..051e31320 100644
--- a/grub-core/commands/parttool.c
+++ b/grub-core/commands/parttool.c
@@ -59,7 +59,13 @@ grub_parttool_register(const char *part_name,
   for (nargs = 0; args[nargs].name != 0; nargs++);
   cur->nargs = nargs;
   cur->args = (struct grub_parttool_argdesc *)
-    grub_malloc ((nargs + 1) * sizeof (struct grub_parttool_argdesc));
+    grub_calloc (nargs + 1, sizeof (struct grub_parttool_argdesc));
+  if (!cur->args)
+    {
+      grub_free (cur);
+      curhandle--;
+      return -1;
+    }
   grub_memcpy (cur->args, args,
 	       (nargs + 1) * sizeof (struct grub_parttool_argdesc));
 
@@ -257,7 +263,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),
 	return err;
       }
 
-  parsed = (int *) grub_zalloc (argc * sizeof (int));
+  parsed = (int *) grub_calloc (argc, sizeof (int));
 
   for (i = 1; i < argc; i++)
     if (! parsed[i])
@@ -290,7 +296,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),
 	  }
 	ptool = cur;
 	pargs = (struct grub_parttool_args *)
-	  grub_zalloc (ptool->nargs * sizeof (struct grub_parttool_args));
+	  grub_calloc (ptool->nargs, sizeof (struct grub_parttool_args));
 	for (j = i; j < argc; j++)
 	  if (! parsed[j])
 	    {
diff --git a/grub-core/commands/regexp.c b/grub-core/commands/regexp.c
index 7c5c72fe4..612003f94 100644
--- a/grub-core/commands/regexp.c
+++ b/grub-core/commands/regexp.c
@@ -116,7 +116,7 @@ grub_cmd_regexp (grub_extcmd_context_t ctxt, int argc, char **args)
   if (ret)
     goto fail;
 
-  matches = grub_zalloc (sizeof (*matches) * (regex.re_nsub + 1));
+  matches = grub_calloc (regex.re_nsub + 1, sizeof (*matches));
   if (! matches)
     goto fail;
 
diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c
index d7fd26b94..47fc8eb99 100644
--- a/grub-core/commands/search_wrap.c
+++ b/grub-core/commands/search_wrap.c
@@ -122,7 +122,7 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args)
     for (i = 0; state[SEARCH_HINT_BAREMETAL].args[i]; i++)
       nhints++;
 
-  hints = grub_malloc (sizeof (hints[0]) * nhints);
+  hints = grub_calloc (nhints, sizeof (hints[0]));
   if (!hints)
     return grub_errno;
   j = 0;
diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
index 67bf37a9c..86557f923 100644
--- a/grub-core/disk/diskfilter.c
+++ b/grub-core/disk/diskfilter.c
@@ -1135,7 +1135,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb,
   array->lvs->segments->node_count = nmemb;
   array->lvs->segments->raid_member_size = disk_size;
   array->lvs->segments->nodes
-    = grub_zalloc (nmemb * sizeof (array->lvs->segments->nodes[0]));
+    = grub_calloc (nmemb, sizeof (array->lvs->segments->nodes[0]));
   array->lvs->segments->stripe_size = stripe_size;
   for (i = 0; i < nmemb; i++)
     {
@@ -1227,7 +1227,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id,
 	  grub_partition_t p;
 	  for (p = disk->partition; p; p = p->parent)
 	    s++;
-	  pv->partmaps = xmalloc (s * sizeof (pv->partmaps[0]));
+	  pv->partmaps = xcalloc (s, sizeof (pv->partmaps[0]));
 	  s = 0;
 	  for (p = disk->partition; p; p = p->parent)
 	    pv->partmaps[s++] = xstrdup (p->partmap->name);
diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c
index f73257e66..03674cb47 100644
--- a/grub-core/disk/ieee1275/ofdisk.c
+++ b/grub-core/disk/ieee1275/ofdisk.c
@@ -297,7 +297,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias)
       /* Power machines documentation specify 672 as maximum SAS disks in
          one system. Using a slightly larger value to be safe. */
       table_size = 768;
-      table = grub_malloc (table_size * sizeof (grub_uint64_t));
+      table = grub_calloc (table_size, sizeof (grub_uint64_t));
 
       if (!table)
         {
diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
index 2a22d2d6c..e6323701a 100644
--- a/grub-core/disk/ldm.c
+++ b/grub-core/disk/ldm.c
@@ -323,8 +323,8 @@ make_vg (grub_disk_t disk,
 	  lv->segments->type = GRUB_DISKFILTER_MIRROR;
 	  lv->segments->node_count = 0;
 	  lv->segments->node_alloc = 8;
-	  lv->segments->nodes = grub_zalloc (sizeof (*lv->segments->nodes)
-					     * lv->segments->node_alloc);
+	  lv->segments->nodes = grub_calloc (lv->segments->node_alloc,
+					     sizeof (*lv->segments->nodes));
 	  if (!lv->segments->nodes)
 	    goto fail2;
 	  ptr = vblk[i].dynamic;
@@ -543,8 +543,8 @@ make_vg (grub_disk_t disk,
 	    {
 	      comp->segment_alloc = 8;
 	      comp->segment_count = 0;
-	      comp->segments = grub_malloc (sizeof (*comp->segments)
-					    * comp->segment_alloc);
+	      comp->segments = grub_calloc (comp->segment_alloc,
+					    sizeof (*comp->segments));
 	      if (!comp->segments)
 		goto fail2;
 	    }
@@ -590,8 +590,8 @@ make_vg (grub_disk_t disk,
 		}
 	      comp->segments->node_count = read_int (ptr + 1, *ptr);
 	      comp->segments->node_alloc = comp->segments->node_count;
-	      comp->segments->nodes = grub_zalloc (sizeof (*comp->segments->nodes)
-						   * comp->segments->node_alloc);
+	      comp->segments->nodes = grub_calloc (comp->segments->node_alloc,
+						   sizeof (*comp->segments->nodes));
 	      if (!lv->segments->nodes)
 		goto fail2;
 	    }
@@ -1017,7 +1017,7 @@ grub_util_ldm_embed (struct grub_disk *disk, unsigned int *nsectors,
       *nsectors = lv->size;
       if (*nsectors > max_nsectors)
 	*nsectors = max_nsectors;
-      *sectors = grub_malloc (*nsectors * sizeof (**sectors));
+      *sectors = grub_calloc (*nsectors, sizeof (**sectors));
       if (!*sectors)
 	return grub_errno;
       for (i = 0; i < *nsectors; i++)
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 410cd6f84..6ae162601 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -178,7 +178,7 @@ luks_recover_key (grub_disk_t source,
 	&& grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)
       max_stripes = grub_be_to_cpu32 (header.keyblock[i].stripes);
 
-  split_key = grub_malloc (keysize * max_stripes);
+  split_key = grub_calloc (keysize, max_stripes);
   if (!split_key)
     return grub_errno;
 
diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
index e47be642a..48e36b4f3 100644
--- a/grub-core/disk/lvm.c
+++ b/grub-core/disk/lvm.c
@@ -210,7 +210,7 @@ grub_lvm_detect (grub_disk_t disk,
      first one.  */
 
   /* Allocate buffer space for the circular worst-case scenario. */
-  metadatabuf = grub_malloc (2 * mda_size);
+  metadatabuf = grub_calloc (2, mda_size);
   if (! metadatabuf)
     goto fail;
 
@@ -465,7 +465,7 @@ grub_lvm_detect (grub_disk_t disk,
 #endif
 		  goto lvs_fail;
 		}
-	      lv->segments = grub_zalloc (sizeof (*seg) * lv->segment_count);
+	      lv->segments = grub_calloc (lv->segment_count, sizeof (*seg));
 	      seg = lv->segments;
 
 	      for (i = 0; i < lv->segment_count; i++)
@@ -522,8 +522,8 @@ grub_lvm_detect (grub_disk_t disk,
 		      if (seg->node_count != 1)
 			seg->stripe_size = grub_lvm_getvalue (&p, "stripe_size = ");
 
-		      seg->nodes = grub_zalloc (sizeof (*stripe)
-						* seg->node_count);
+		      seg->nodes = grub_calloc (seg->node_count,
+						sizeof (*stripe));
 		      stripe = seg->nodes;
 
 		      p = grub_strstr (p, "stripes = [");
@@ -899,7 +899,7 @@ grub_lvm_detect (grub_disk_t disk,
 		break;
 	    if (lv)
 	      {
-		cache->lv->segments = grub_malloc (lv->segment_count * sizeof (*lv->segments));
+		cache->lv->segments = grub_calloc (lv->segment_count, sizeof (*lv->segments));
 		if (!cache->lv->segments)
 		  {
 		    grub_lvm_free_cache_lvs (cache_lvs);
@@ -912,7 +912,7 @@ grub_lvm_detect (grub_disk_t disk,
 		    struct grub_diskfilter_node *nodes = lv->segments[i].nodes;
 		    grub_size_t node_count = lv->segments[i].node_count;
 
-		    cache->lv->segments[i].nodes = grub_malloc (node_count * sizeof (*nodes));
+		    cache->lv->segments[i].nodes = grub_calloc (node_count, sizeof (*nodes));
 		    if (!cache->lv->segments[i].nodes)
 		      {
 			for (j = 0; j < i; ++j)
diff --git a/grub-core/disk/xen/xendisk.c b/grub-core/disk/xen/xendisk.c
index 48476cbbf..d6612eebd 100644
--- a/grub-core/disk/xen/xendisk.c
+++ b/grub-core/disk/xen/xendisk.c
@@ -426,7 +426,7 @@ grub_xendisk_init (void)
   if (!ctr)
     return;
 
-  virtdisks = grub_malloc (ctr * sizeof (virtdisks[0]));
+  virtdisks = grub_calloc (ctr, sizeof (virtdisks[0]));
   if (!virtdisks)
     return;
   if (grub_xenstore_dir ("device/vbd", fill, &ctr))
diff --git a/grub-core/efiemu/loadcore.c b/grub-core/efiemu/loadcore.c
index 44085ef81..2b924623f 100644
--- a/grub-core/efiemu/loadcore.c
+++ b/grub-core/efiemu/loadcore.c
@@ -201,7 +201,7 @@ grub_efiemu_count_symbols (const Elf_Ehdr *e)
 
   grub_efiemu_nelfsyms = (unsigned) s->sh_size / (unsigned) s->sh_entsize;
   grub_efiemu_elfsyms = (struct grub_efiemu_elf_sym *)
-    grub_malloc (sizeof (struct grub_efiemu_elf_sym) * grub_efiemu_nelfsyms);
+    grub_calloc (grub_efiemu_nelfsyms, sizeof (struct grub_efiemu_elf_sym));
 
   /* Relocators */
   for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff);
diff --git a/grub-core/efiemu/mm.c b/grub-core/efiemu/mm.c
index 52a032f7b..9b8e0d0ad 100644
--- a/grub-core/efiemu/mm.c
+++ b/grub-core/efiemu/mm.c
@@ -554,11 +554,11 @@ grub_efiemu_mmap_sort_and_uniq (void)
   /* Initialize variables*/
   grub_memset (present, 0, sizeof (int) * GRUB_EFI_MAX_MEMORY_TYPE);
   scanline_events = (struct grub_efiemu_mmap_scan *)
-    grub_malloc (sizeof (struct grub_efiemu_mmap_scan) * 2 * mmap_num);
+    grub_calloc (mmap_num, sizeof (struct grub_efiemu_mmap_scan) * 2);
 
   /* Number of chunks can't increase more than by factor of 2 */
   result = (grub_efi_memory_descriptor_t *)
-    grub_malloc (sizeof (grub_efi_memory_descriptor_t) * 2 * mmap_num);
+    grub_calloc (mmap_num, sizeof (grub_efi_memory_descriptor_t) * 2);
   if (!result || !scanline_events)
     {
       grub_free (result);
@@ -660,7 +660,7 @@ grub_efiemu_mm_do_alloc (void)
 
   /* Preallocate mmap */
   efiemu_mmap = (grub_efi_memory_descriptor_t *)
-    grub_malloc (mmap_reserved_size * sizeof (grub_efi_memory_descriptor_t));
+    grub_calloc (mmap_reserved_size, sizeof (grub_efi_memory_descriptor_t));
   if (!efiemu_mmap)
     {
       grub_efiemu_unload ();
diff --git a/grub-core/font/font.c b/grub-core/font/font.c
index 85a292557..8e118b315 100644
--- a/grub-core/font/font.c
+++ b/grub-core/font/font.c
@@ -293,8 +293,7 @@ load_font_index (grub_file_t file, grub_uint32_t sect_length, struct
   font->num_chars = sect_length / FONT_CHAR_INDEX_ENTRY_SIZE;
 
   /* Allocate the character index array.  */
-  font->char_index = grub_malloc (font->num_chars
-				  * sizeof (struct char_index_entry));
+  font->char_index = grub_calloc (font->num_chars, sizeof (struct char_index_entry));
   if (!font->char_index)
     return 1;
   font->bmp_idx = grub_malloc (0x10000 * sizeof (grub_uint16_t));
diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
index 6b6a2bc91..220b3712f 100644
--- a/grub-core/fs/affs.c
+++ b/grub-core/fs/affs.c
@@ -301,7 +301,7 @@ grub_affs_read_symlink (grub_fshelp_node_t node)
       return 0;
     }
   latin1[symlink_size] = 0;
-  utf8 = grub_malloc (symlink_size * GRUB_MAX_UTF8_PER_LATIN1 + 1);
+  utf8 = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, symlink_size);
   if (!utf8)
     {
       grub_free (latin1);
@@ -422,7 +422,7 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir,
 	return 1;
     }
 
-  hashtable = grub_zalloc (data->htsize * sizeof (*hashtable));
+  hashtable = grub_calloc (data->htsize, sizeof (*hashtable));
   if (!hashtable)
     return 1;
 
@@ -628,7 +628,7 @@ grub_affs_label (grub_device_t device, char **label)
       len = file.namelen;
       if (len > sizeof (file.name))
 	len = sizeof (file.name);
-      *label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);
+      *label = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, len);
       if (*label)
 	*grub_latin1_to_utf8 ((grub_uint8_t *) *label, file.name, len) = '\0';
     }
diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
index 63f9657a6..4b8380439 100644
--- a/grub-core/fs/btrfs.c
+++ b/grub-core/fs/btrfs.c
@@ -415,7 +415,7 @@ lower_bound (struct grub_btrfs_data *data,
     {
       desc->allocated = 16;
       desc->depth = 0;
-      desc->data = grub_malloc (sizeof (desc->data[0]) * desc->allocated);
+      desc->data = grub_calloc (desc->allocated, sizeof (desc->data[0]));
       if (!desc->data)
 	return grub_errno;
     }
@@ -754,7 +754,7 @@ raid56_read_retry (struct grub_btrfs_data *data,
   grub_err_t ret = GRUB_ERR_OUT_OF_MEMORY;
   grub_uint64_t i, failed_devices;
 
-  buffers = grub_zalloc (sizeof(*buffers) * nstripes);
+  buffers = grub_calloc (nstripes, sizeof (*buffers));
   if (!buffers)
     goto cleanup;
 
@@ -2167,7 +2167,7 @@ grub_btrfs_embed (grub_device_t device __attribute__ ((unused)),
   *nsectors = 64 * 2 - 1;
   if (*nsectors > max_nsectors)
     *nsectors = max_nsectors;
-  *sectors = grub_malloc (*nsectors * sizeof (**sectors));
+  *sectors = grub_calloc (*nsectors, sizeof (**sectors));
   if (!*sectors)
     return grub_errno;
   for (i = 0; i < *nsectors; i++)
diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
index ac0a40990..3fe842b4d 100644
--- a/grub-core/fs/hfs.c
+++ b/grub-core/fs/hfs.c
@@ -1360,7 +1360,7 @@ grub_hfs_label (grub_device_t device, char **label)
       grub_size_t len = data->sblock.volname[0];
       if (len > sizeof (data->sblock.volname) - 1)
 	len = sizeof (data->sblock.volname) - 1;
-      *label = grub_malloc (len * MAX_UTF8_PER_MAC_ROMAN + 1);
+      *label = grub_calloc (MAX_UTF8_PER_MAC_ROMAN + 1, len);
       if (*label)
 	macroman_to_utf8 (*label, data->sblock.volname + 1,
 			  len + 1, 0);
diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
index 54786bb1c..dae43becc 100644
--- a/grub-core/fs/hfsplus.c
+++ b/grub-core/fs/hfsplus.c
@@ -720,7 +720,7 @@ list_nodes (void *record, void *hook_arg)
   if (! filename)
     return 0;
 
-  keyname = grub_malloc (grub_be_to_cpu16 (catkey->namelen) * sizeof (*keyname));
+  keyname = grub_calloc (grub_be_to_cpu16 (catkey->namelen), sizeof (*keyname));
   if (!keyname)
     {
       grub_free (filename);
@@ -1007,7 +1007,7 @@ grub_hfsplus_label (grub_device_t device, char **label)
     grub_hfsplus_btree_recptr (&data->catalog_tree, node, ptr);
 
   label_len = grub_be_to_cpu16 (catkey->namelen);
-  label_name = grub_malloc (label_len * sizeof (*label_name));
+  label_name = grub_calloc (label_len, sizeof (*label_name));
   if (!label_name)
     {
       grub_free (node);
@@ -1029,7 +1029,7 @@ grub_hfsplus_label (grub_device_t device, char **label)
 	}
     }
 
-  *label = grub_malloc (label_len * GRUB_MAX_UTF8_PER_UTF16 + 1);
+  *label = grub_calloc (label_len, GRUB_MAX_UTF8_PER_UTF16 + 1);
   if (! *label)
     {
       grub_free (label_name);
diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
index 49c0c632b..4f1b52a55 100644
--- a/grub-core/fs/iso9660.c
+++ b/grub-core/fs/iso9660.c
@@ -331,7 +331,7 @@ grub_iso9660_convert_string (grub_uint8_t *us, int len)
   int i;
   grub_uint16_t t[MAX_NAMELEN / 2 + 1];
 
-  p = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1);
+  p = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1);
   if (! p)
     return NULL;
 
diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
index fc4e1f678..2f34f76da 100644
--- a/grub-core/fs/ntfs.c
+++ b/grub-core/fs/ntfs.c
@@ -556,8 +556,8 @@ get_utf8 (grub_uint8_t *in, grub_size_t len)
   grub_uint16_t *tmp;
   grub_size_t i;
 
-  buf = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1);
-  tmp = grub_malloc (len * sizeof (tmp[0]));
+  buf = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1);
+  tmp = grub_calloc (len, sizeof (tmp[0]));
   if (!buf || !tmp)
     {
       grub_free (buf);
diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
index 50c1fe72f..90f7fb379 100644
--- a/grub-core/fs/sfs.c
+++ b/grub-core/fs/sfs.c
@@ -266,7 +266,7 @@ grub_sfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
       node->next_extent = node->block;
       node->cache_size = 0;
 
-      node->cache = grub_malloc (sizeof (node->cache[0]) * cache_size);
+      node->cache = grub_calloc (cache_size, sizeof (node->cache[0]));
       if (!node->cache)
 	{
 	  grub_errno = 0;
diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
index 7d63e0c99..c551ed6b5 100644
--- a/grub-core/fs/tar.c
+++ b/grub-core/fs/tar.c
@@ -120,7 +120,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
 	  if (data->linkname_alloc < linksize + 1)
 	    {
 	      char *n;
-	      n = grub_malloc (2 * (linksize + 1));
+	      n = grub_calloc (2, linksize + 1);
 	      if (!n)
 		return grub_errno;
 	      grub_free (data->linkname);
diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
index dc8b6e2d1..a83761674 100644
--- a/grub-core/fs/udf.c
+++ b/grub-core/fs/udf.c
@@ -873,7 +873,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)
     {
       unsigned i;
       utf16len = sz - 1;
-      utf16 = grub_malloc (utf16len * sizeof (utf16[0]));
+      utf16 = grub_calloc (utf16len, sizeof (utf16[0]));
       if (!utf16)
 	return NULL;
       for (i = 0; i < utf16len; i++)
@@ -883,7 +883,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)
     {
       unsigned i;
       utf16len = (sz - 1) / 2;
-      utf16 = grub_malloc (utf16len * sizeof (utf16[0]));
+      utf16 = grub_calloc (utf16len, sizeof (utf16[0]));
       if (!utf16)
 	return NULL;
       for (i = 0; i < utf16len; i++)
diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
index b5e10fd0b..0c676ac41 100644
--- a/grub-core/fs/zfs/zfs.c
+++ b/grub-core/fs/zfs/zfs.c
@@ -3328,7 +3328,7 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol,
 	}
       subvol->nkeys = 0;
       zap_iterate (&keychain_dn, 8, count_zap_keys, &ctx, data);
-      subvol->keyring = grub_zalloc (subvol->nkeys * sizeof (subvol->keyring[0]));
+      subvol->keyring = grub_calloc (subvol->nkeys, sizeof (subvol->keyring[0]));
       if (!subvol->keyring)
 	{
 	  grub_free (fsname);
@@ -4339,7 +4339,7 @@ grub_zfs_embed (grub_device_t device __attribute__ ((unused)),
   *nsectors = (VDEV_BOOT_SIZE >> GRUB_DISK_SECTOR_BITS);
   if (*nsectors > max_nsectors)
     *nsectors = max_nsectors;
-  *sectors = grub_malloc (*nsectors * sizeof (**sectors));
+  *sectors = grub_calloc (*nsectors, sizeof (**sectors));
   if (!*sectors)
     return grub_errno;
   for (i = 0; i < *nsectors; i++)
diff --git a/grub-core/gfxmenu/gui_string_util.c b/grub-core/gfxmenu/gui_string_util.c
index a9a415e31..ba1e1eab3 100644
--- a/grub-core/gfxmenu/gui_string_util.c
+++ b/grub-core/gfxmenu/gui_string_util.c
@@ -55,7 +55,7 @@ canonicalize_path (const char *path)
     if (*p == '/')
       components++;
 
-  char **path_array = grub_malloc (components * sizeof (*path_array));
+  char **path_array = grub_calloc (components, sizeof (*path_array));
   if (! path_array)
     return 0;
 
diff --git a/grub-core/gfxmenu/widget-box.c b/grub-core/gfxmenu/widget-box.c
index b60602889..470597ded 100644
--- a/grub-core/gfxmenu/widget-box.c
+++ b/grub-core/gfxmenu/widget-box.c
@@ -303,10 +303,10 @@ grub_gfxmenu_create_box (const char *pixmaps_prefix,
   box->content_height = 0;
   box->raw_pixmaps =
     (struct grub_video_bitmap **)
-    grub_malloc (BOX_NUM_PIXMAPS * sizeof (struct grub_video_bitmap *));
+    grub_calloc (BOX_NUM_PIXMAPS, sizeof (struct grub_video_bitmap *));
   box->scaled_pixmaps =
     (struct grub_video_bitmap **)
-    grub_malloc (BOX_NUM_PIXMAPS * sizeof (struct grub_video_bitmap *));
+    grub_calloc (BOX_NUM_PIXMAPS, sizeof (struct grub_video_bitmap *));
 
   /* Initialize all pixmap pointers to NULL so that proper destruction can
      be performed if an error is encountered partway through construction.  */
diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c
index 6208a9763..43d98a7bd 100644
--- a/grub-core/io/gzio.c
+++ b/grub-core/io/gzio.c
@@ -554,7 +554,7 @@ huft_build (unsigned *b,	/* code lengths in bits (all assumed <= BMAX) */
 	      z = 1 << j;	/* table entries for j-bit table */
 
 	      /* allocate and link in new table */
-	      q = (struct huft *) grub_zalloc ((z + 1) * sizeof (struct huft));
+	      q = (struct huft *) grub_calloc (z + 1, sizeof (struct huft));
 	      if (! q)
 		{
 		  if (h)
diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
index 3a708ed72..b2d07a3fa 100644
--- a/grub-core/kern/efi/efi.c
+++ b/grub-core/kern/efi/efi.c
@@ -202,7 +202,7 @@ grub_efi_set_variable(const char *var, const grub_efi_guid_t *guid,
 
   len = grub_strlen (var);
   len16 = len * GRUB_MAX_UTF16_PER_UTF8;
-  var16 = grub_malloc ((len16 + 1) * sizeof (var16[0]));
+  var16 = grub_calloc (len16 + 1, sizeof (var16[0]));
   if (!var16)
     return grub_errno;
   len16 = grub_utf8_to_utf16 (var16, len16, (grub_uint8_t *) var, len, NULL);
@@ -237,7 +237,7 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
 
   len = grub_strlen (var);
   len16 = len * GRUB_MAX_UTF16_PER_UTF8;
-  var16 = grub_malloc ((len16 + 1) * sizeof (var16[0]));
+  var16 = grub_calloc (len16 + 1, sizeof (var16[0]));
   if (!var16)
     return NULL;
   len16 = grub_utf8_to_utf16 (var16, len16, (grub_uint8_t *) var, len, NULL);
@@ -393,7 +393,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0)
 	  while (len > 0 && fp->path_name[len - 1] == 0)
 	    len--;
 
-	  dup_name = grub_malloc (len * sizeof (*dup_name));
+	  dup_name = grub_calloc (len, sizeof (*dup_name));
 	  if (!dup_name)
 	    {
 	      grub_free (name);
diff --git a/grub-core/kern/emu/hostdisk.c b/grub-core/kern/emu/hostdisk.c
index e9ec680cd..d975265b2 100644
--- a/grub-core/kern/emu/hostdisk.c
+++ b/grub-core/kern/emu/hostdisk.c
@@ -615,7 +615,7 @@ static char *
 grub_util_path_concat_real (size_t n, int ext, va_list ap)
 {
   size_t totlen = 0;
-  char **l = xmalloc ((n + ext) * sizeof (l[0]));
+  char **l = xcalloc (n + ext, sizeof (l[0]));
   char *r, *p, *pi;
   size_t i;
   int first = 1;
diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c
index 88d39360d..fb30da9f4 100644
--- a/grub-core/kern/fs.c
+++ b/grub-core/kern/fs.c
@@ -151,7 +151,7 @@ grub_fs_blocklist_open (grub_file_t file, const char *name)
   while (p);
 
   /* Allocate a block list.  */
-  blocks = grub_zalloc (sizeof (struct grub_fs_block) * (num + 1));
+  blocks = grub_calloc (num + 1, sizeof (struct grub_fs_block));
   if (! blocks)
     return 0;
 
diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
index ce92ddd07..a278e069b 100644
--- a/grub-core/kern/misc.c
+++ b/grub-core/kern/misc.c
@@ -704,7 +704,7 @@ parse_printf_args (const char *fmt0, struct printf_args *args,
     args->ptr = args->prealloc;
   else
     {
-      args->ptr = grub_malloc (args->count * sizeof (args->ptr[0]));
+      args->ptr = grub_calloc (args->count, sizeof (args->ptr[0]));
       if (!args->ptr)
 	{
 	  grub_errno = GRUB_ERR_NONE;
diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c
index 78175aac2..619db3122 100644
--- a/grub-core/kern/parser.c
+++ b/grub-core/kern/parser.c
@@ -213,7 +213,7 @@ grub_parser_split_cmdline (const char *cmdline,
     return grub_errno;
   grub_memcpy (args, buffer, bp - buffer);
 
-  *argv = grub_malloc (sizeof (char *) * (*argc + 1));
+  *argv = grub_calloc (*argc + 1, sizeof (char *));
   if (!*argv)
     {
       grub_free (args);
diff --git a/grub-core/kern/uboot/uboot.c b/grub-core/kern/uboot/uboot.c
index be4816fe6..aac8f9ae1 100644
--- a/grub-core/kern/uboot/uboot.c
+++ b/grub-core/kern/uboot/uboot.c
@@ -133,7 +133,7 @@ grub_uboot_dev_enum (void)
     return num_devices;
 
   max_devices = 2;
-  enum_devices = grub_malloc (sizeof(struct device_info) * max_devices);
+  enum_devices = grub_calloc (max_devices, sizeof(struct device_info));
   if (!enum_devices)
     return 0;
 
diff --git a/grub-core/lib/json/json.c b/grub-core/lib/json/json.c
index 694af4f3a..913b8f404 100644
--- a/grub-core/lib/json/json.c
+++ b/grub-core/lib/json/json.c
@@ -53,7 +53,7 @@ grub_json_parse (grub_json_t **out, char *string, grub_size_t string_len)
       goto err;
     }
 
-  json->tokens = grub_malloc (sizeof (jsmntok_t) * jsmn_ret);
+  json->tokens = grub_calloc (jsmn_ret, sizeof (jsmntok_t));
   if (!json->tokens)
     {
       ret = GRUB_ERR_OUT_OF_MEMORY;
diff --git a/grub-core/lib/libgcrypt/cipher/ac.c b/grub-core/lib/libgcrypt/cipher/ac.c
index f5e946a2d..63f6fcd11 100644
--- a/grub-core/lib/libgcrypt/cipher/ac.c
+++ b/grub-core/lib/libgcrypt/cipher/ac.c
@@ -185,7 +185,7 @@ ac_data_mpi_copy (gcry_ac_mpi_t *data_mpis, unsigned int data_mpis_n,
   gcry_mpi_t mpi;
   char *label;
 
-  data_mpis_new = gcry_malloc (sizeof (*data_mpis_new) * data_mpis_n);
+  data_mpis_new = gcry_calloc (data_mpis_n, sizeof (*data_mpis_new));
   if (! data_mpis_new)
     {
       err = gcry_error_from_errno (errno);
@@ -572,7 +572,7 @@ _gcry_ac_data_to_sexp (gcry_ac_data_t data, gcry_sexp_t *sexp,
     }
 
   /* Add MPI list.  */
-  arg_list = gcry_malloc (sizeof (*arg_list) * (data_n + 1));
+  arg_list = gcry_calloc (data_n + 1, sizeof (*arg_list));
   if (! arg_list)
     {
       err = gcry_error_from_errno (errno);
@@ -1283,7 +1283,7 @@ ac_data_construct (const char *identifier, int include_flags,
   /* We build a list of arguments to pass to
      gcry_sexp_build_array().  */
   data_length = _gcry_ac_data_length (data);
-  arg_list = gcry_malloc (sizeof (*arg_list) * (data_length * 2));
+  arg_list = gcry_calloc (data_length, sizeof (*arg_list) * 2);
   if (! arg_list)
     {
       err = gcry_error_from_errno (errno);
@@ -1593,7 +1593,7 @@ _gcry_ac_key_pair_generate (gcry_ac_handle_t handle, unsigned int nbits,
 	arg_list_n += 2;
 
   /* Allocate list.  */
-  arg_list = gcry_malloc (sizeof (*arg_list) * arg_list_n);
+  arg_list = gcry_calloc (arg_list_n, sizeof (*arg_list));
   if (! arg_list)
     {
       err = gcry_error_from_errno (errno);
diff --git a/grub-core/lib/libgcrypt/cipher/primegen.c b/grub-core/lib/libgcrypt/cipher/primegen.c
index 2788e349f..b12e79b19 100644
--- a/grub-core/lib/libgcrypt/cipher/primegen.c
+++ b/grub-core/lib/libgcrypt/cipher/primegen.c
@@ -383,7 +383,7 @@ prime_generate_internal (int need_q_factor,
     }
 
   /* Allocate an array to track pool usage. */
-  pool_in_use = gcry_malloc (n * sizeof *pool_in_use);
+  pool_in_use = gcry_calloc (n, sizeof *pool_in_use);
   if (!pool_in_use)
     {
       err = gpg_err_code_from_errno (errno);
@@ -765,7 +765,7 @@ gen_prime (unsigned int nbits, int secret, int randomlevel,
   if (nbits < 16)
     log_fatal ("can't generate a prime with less than %d bits\n", 16);
 
-  mods = gcry_xmalloc( no_of_small_prime_numbers * sizeof *mods );
+  mods = gcry_xcalloc( no_of_small_prime_numbers, sizeof *mods);
   /* Make nbits fit into gcry_mpi_t implementation. */
   val_2  = mpi_alloc_set_ui( 2 );
   val_3 = mpi_alloc_set_ui( 3);
diff --git a/grub-core/lib/libgcrypt/cipher/pubkey.c b/grub-core/lib/libgcrypt/cipher/pubkey.c
index 910982141..ca087ad75 100644
--- a/grub-core/lib/libgcrypt/cipher/pubkey.c
+++ b/grub-core/lib/libgcrypt/cipher/pubkey.c
@@ -2941,7 +2941,7 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gcry_sexp_t s_data, gcry_sexp_t s_pkey)
        * array to a format string, so we have to do it this way :-(.  */
       /* FIXME: There is now such a format specifier, so we can
          change the code to be more clear. */
-      arg_list = malloc (nelem * sizeof *arg_list);
+      arg_list = calloc (nelem, sizeof *arg_list);
       if (!arg_list)
         {
           rc = gpg_err_code_from_syserror ();
@@ -3233,7 +3233,7 @@ gcry_pk_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_hash, gcry_sexp_t s_skey)
         }
       strcpy (p, "))");
 
-      arg_list = malloc (nelem * sizeof *arg_list);
+      arg_list = calloc (nelem, sizeof *arg_list);
       if (!arg_list)
         {
           rc = gpg_err_code_from_syserror ();
diff --git a/grub-core/lib/priority_queue.c b/grub-core/lib/priority_queue.c
index 659be0b7f..7d5e7c05a 100644
--- a/grub-core/lib/priority_queue.c
+++ b/grub-core/lib/priority_queue.c
@@ -92,7 +92,7 @@ grub_priority_queue_new (grub_size_t elsize,
 {
   struct grub_priority_queue *ret;
   void *els;
-  els = grub_malloc (elsize * 8);
+  els = grub_calloc (8, elsize);
   if (!els)
     return 0;
   ret = (struct grub_priority_queue *) grub_malloc (sizeof (*ret));
diff --git a/grub-core/lib/reed_solomon.c b/grub-core/lib/reed_solomon.c
index ee9fa7b4f..467305b46 100644
--- a/grub-core/lib/reed_solomon.c
+++ b/grub-core/lib/reed_solomon.c
@@ -20,6 +20,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#define xcalloc calloc
 #define xmalloc malloc
 #define grub_memset memset
 #define grub_memcpy memcpy
@@ -158,11 +159,9 @@ rs_encode (gf_single_t *data, grub_size_t s, grub_size_t rs)
   gf_single_t *rs_polynomial;
   int i, j;
   gf_single_t *m;
-  m = xmalloc ((s + rs) * sizeof (gf_single_t));
+  m = xcalloc (s + rs, sizeof (gf_single_t));
   grub_memcpy (m, data, s * sizeof (gf_single_t));
-  grub_memset (m + s, 0, rs * sizeof (gf_single_t));
-  rs_polynomial = xmalloc ((rs + 1) * sizeof (gf_single_t));
-  grub_memset (rs_polynomial, 0, (rs + 1) * sizeof (gf_single_t));
+  rs_polynomial = xcalloc (rs + 1, sizeof (gf_single_t));
   rs_polynomial[rs] = 1;
   /* Multiply with X - a^r */
   for (j = 0; j < rs; j++)
diff --git a/grub-core/lib/relocator.c b/grub-core/lib/relocator.c
index ea3ebc719..5847aac36 100644
--- a/grub-core/lib/relocator.c
+++ b/grub-core/lib/relocator.c
@@ -495,9 +495,9 @@ malloc_in_range (struct grub_relocator *rel,
   }
 #endif
 
-  eventt = grub_malloc (maxevents * sizeof (events[0]));
+  eventt = grub_calloc (maxevents, sizeof (events[0]));
   counter = grub_malloc ((DIGITSORT_MASK + 2) * sizeof (counter[0]));
-  events = grub_malloc (maxevents * sizeof (events[0]));
+  events = grub_calloc (maxevents, sizeof (events[0]));
   if (!events || !eventt || !counter)
     {
       grub_dprintf ("relocator", "events or counter allocation failed %d\n",
@@ -963,7 +963,7 @@ malloc_in_range (struct grub_relocator *rel,
 #endif
     unsigned cural = 0;
     int oom = 0;
-    res->subchunks = grub_malloc (sizeof (res->subchunks[0]) * nallocs);
+    res->subchunks = grub_calloc (nallocs, sizeof (res->subchunks[0]));
     if (!res->subchunks)
       oom = 1;
     res->nsubchunks = nallocs;
@@ -1562,8 +1562,8 @@ grub_relocator_prepare_relocs (struct grub_relocator *rel, grub_addr_t addr,
 	    count[(chunk->src & 0xff) + 1]++;
 	  }
     }
-    from = grub_malloc (nchunks * sizeof (sorted[0]));
-    to = grub_malloc (nchunks * sizeof (sorted[0]));
+    from = grub_calloc (nchunks, sizeof (sorted[0]));
+    to = grub_calloc (nchunks, sizeof (sorted[0]));
     if (!from || !to)
       {
 	grub_free (from);
diff --git a/grub-core/lib/zstd/fse_decompress.c b/grub-core/lib/zstd/fse_decompress.c
index 72bbead5b..2227b84bc 100644
--- a/grub-core/lib/zstd/fse_decompress.c
+++ b/grub-core/lib/zstd/fse_decompress.c
@@ -82,7 +82,7 @@
 FSE_DTable* FSE_createDTable (unsigned tableLog)
 {
     if (tableLog > FSE_TABLELOG_ABSOLUTE_MAX) tableLog = FSE_TABLELOG_ABSOLUTE_MAX;
-    return (FSE_DTable*)malloc( FSE_DTABLE_SIZE_U32(tableLog) * sizeof (U32) );
+    return (FSE_DTable*)calloc( FSE_DTABLE_SIZE_U32(tableLog), sizeof (U32) );
 }
 
 void FSE_freeDTable (FSE_DTable* dt)
diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c
index 51684914c..d70c17486 100644
--- a/grub-core/loader/arm/linux.c
+++ b/grub-core/loader/arm/linux.c
@@ -78,7 +78,7 @@ linux_prepare_atag (void *target_atag)
 
   /* some place for cmdline, initrd and terminator.  */
   tmp_size = get_atag_size (atag_orig) + 20 + (arg_size) / 4;
-  tmp_atag = grub_malloc (tmp_size * sizeof (grub_uint32_t));
+  tmp_atag = grub_calloc (tmp_size, sizeof (grub_uint32_t));
   if (!tmp_atag)
     return grub_errno;
 
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
index cd92ea3f2..daf8c6b54 100644
--- a/grub-core/loader/efi/chainloader.c
+++ b/grub-core/loader/efi/chainloader.c
@@ -116,7 +116,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
   fp->header.type = GRUB_EFI_MEDIA_DEVICE_PATH_TYPE;
   fp->header.subtype = GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE;
 
-  path_name = grub_malloc (len * GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
+  path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
   if (!path_name)
     return;
 
diff --git a/grub-core/loader/i386/bsdXX.c b/grub-core/loader/i386/bsdXX.c
index af6741d15..a8d8bf7da 100644
--- a/grub-core/loader/i386/bsdXX.c
+++ b/grub-core/loader/i386/bsdXX.c
@@ -48,7 +48,7 @@ read_headers (grub_file_t file, const char *filename, Elf_Ehdr *e, char **shdr)
   if (e->e_ident[EI_CLASS] != SUFFIX (ELFCLASS))
     return grub_error (GRUB_ERR_BAD_OS, N_("invalid arch-dependent ELF magic"));
 
-  *shdr = grub_malloc ((grub_uint32_t) e->e_shnum * e->e_shentsize);
+  *shdr = grub_calloc (e->e_shnum, e->e_shentsize);
   if (! *shdr)
     return grub_errno;
 
diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c
index e64ed08f5..b7d176b5d 100644
--- a/grub-core/loader/i386/xnu.c
+++ b/grub-core/loader/i386/xnu.c
@@ -295,7 +295,7 @@ grub_xnu_devprop_add_property_utf8 (struct grub_xnu_devprop_device_descriptor *d
     return grub_errno;
 
   len = grub_strlen (name);
-  utf16 = grub_malloc (sizeof (grub_uint16_t) * len);
+  utf16 = grub_calloc (len, sizeof (grub_uint16_t));
   if (!utf16)
     {
       grub_free (utf8);
@@ -331,7 +331,7 @@ grub_xnu_devprop_add_property_utf16 (struct grub_xnu_devprop_device_descriptor *
   grub_uint16_t *utf16;
   grub_err_t err;
 
-  utf16 = grub_malloc (sizeof (grub_uint16_t) * namelen);
+  utf16 = grub_calloc (namelen, sizeof (grub_uint16_t));
   if (!utf16)
     return grub_errno;
   grub_memcpy (utf16, name, sizeof (grub_uint16_t) * namelen);
diff --git a/grub-core/loader/macho.c b/grub-core/loader/macho.c
index 085f9c689..05710c48e 100644
--- a/grub-core/loader/macho.c
+++ b/grub-core/loader/macho.c
@@ -97,7 +97,7 @@ grub_macho_file (grub_file_t file, const char *filename, int is_64bit)
       if (grub_file_seek (macho->file, sizeof (struct grub_macho_fat_header))
 	  == (grub_off_t) -1)
 	goto fail;
-      archs = grub_malloc (sizeof (struct grub_macho_fat_arch) * narchs);
+      archs = grub_calloc (narchs, sizeof (struct grub_macho_fat_arch));
       if (!archs)
 	goto fail;
       if (grub_file_read (macho->file, archs,
diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c
index 70cd1db51..cc6853692 100644
--- a/grub-core/loader/multiboot_elfxx.c
+++ b/grub-core/loader/multiboot_elfxx.c
@@ -217,7 +217,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
     {
       grub_uint8_t *shdr, *shdrptr;
 
-      shdr = grub_malloc ((grub_uint32_t) ehdr->e_shnum * ehdr->e_shentsize);
+      shdr = grub_calloc (ehdr->e_shnum, ehdr->e_shentsize);
       if (!shdr)
 	return grub_errno;
       
diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
index 7f74d1d6f..77d7060e1 100644
--- a/grub-core/loader/xnu.c
+++ b/grub-core/loader/xnu.c
@@ -800,7 +800,7 @@ grub_cmd_xnu_mkext (grub_command_t cmd __attribute__ ((unused)),
   if (grub_be_to_cpu32 (head.magic) == GRUB_MACHO_FAT_MAGIC)
     {
       narchs = grub_be_to_cpu32 (head.nfat_arch);
-      archs = grub_malloc (sizeof (struct grub_macho_fat_arch) * narchs);
+      archs = grub_calloc (narchs, sizeof (struct grub_macho_fat_arch));
       if (! archs)
 	{
 	  grub_file_close (file);
diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
index b569cb23b..64684c23d 100644
--- a/grub-core/mmap/mmap.c
+++ b/grub-core/mmap/mmap.c
@@ -143,9 +143,9 @@ grub_mmap_iterate (grub_memory_hook_t hook, void *hook_data)
 
   /* Initialize variables. */
   ctx.scanline_events = (struct grub_mmap_scan *)
-    grub_malloc (sizeof (struct grub_mmap_scan) * 2 * mmap_num);
+    grub_calloc (mmap_num, sizeof (struct grub_mmap_scan) * 2);
 
-  present = grub_zalloc (sizeof (present[0]) * current_priority);
+  present = grub_calloc (current_priority, sizeof (present[0]));
 
   if (! ctx.scanline_events || !present)
     {
diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c
index 351ec2b45..e33be51f8 100644
--- a/grub-core/net/bootp.c
+++ b/grub-core/net/bootp.c
@@ -802,7 +802,7 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)),
   if (ncards == 0)
     return grub_error (GRUB_ERR_NET_NO_CARD, N_("no network card found"));
 
-  ifaces = grub_zalloc (ncards * sizeof (ifaces[0]));
+  ifaces = grub_calloc (ncards, sizeof (ifaces[0]));
   if (!ifaces)
     return grub_errno;
 
diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c
index 5d9afe093..e332d5eb4 100644
--- a/grub-core/net/dns.c
+++ b/grub-core/net/dns.c
@@ -285,8 +285,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
       ptr++;
       ptr += 4;
     }
-  *data->addresses = grub_malloc (sizeof ((*data->addresses)[0])
-				 * grub_be_to_cpu16 (head->ancount));
+  *data->addresses = grub_calloc (grub_be_to_cpu16 (head->ancount),
+				  sizeof ((*data->addresses)[0]));
   if (!*data->addresses)
     {
       grub_errno = GRUB_ERR_NONE;
@@ -406,8 +406,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
       dns_cache[h].addresses = 0;
       dns_cache[h].name = grub_strdup (data->oname);
       dns_cache[h].naddresses = *data->naddresses;
-      dns_cache[h].addresses = grub_malloc (*data->naddresses
-					    * sizeof (dns_cache[h].addresses[0]));
+      dns_cache[h].addresses = grub_calloc (*data->naddresses,
+					    sizeof (dns_cache[h].addresses[0]));
       dns_cache[h].limit_time = grub_get_time_ms () + 1000 * ttl_all;
       if (!dns_cache[h].addresses || !dns_cache[h].name)
 	{
@@ -479,7 +479,7 @@ grub_net_dns_lookup (const char *name,
 	}
     }
 
-  sockets = grub_malloc (sizeof (sockets[0]) * n_servers);
+  sockets = grub_calloc (n_servers, sizeof (sockets[0]));
   if (!sockets)
     return grub_errno;
 
diff --git a/grub-core/net/net.c b/grub-core/net/net.c
index 3a310c939..04ad10682 100644
--- a/grub-core/net/net.c
+++ b/grub-core/net/net.c
@@ -333,8 +333,8 @@ grub_cmd_ipv6_autoconf (struct grub_command *cmd __attribute__ ((unused)),
     ncards++;
   }
 
-  ifaces = grub_zalloc (ncards * sizeof (ifaces[0]));
-  slaacs = grub_zalloc (ncards * sizeof (slaacs[0]));
+  ifaces = grub_calloc (ncards, sizeof (ifaces[0]));
+  slaacs = grub_calloc (ncards, sizeof (slaacs[0]));
   if (!ifaces || !slaacs)
     {
       grub_free (ifaces);
diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c
index b0ab47d73..d57fb72fa 100644
--- a/grub-core/normal/charset.c
+++ b/grub-core/normal/charset.c
@@ -203,7 +203,7 @@ grub_utf8_to_ucs4_alloc (const char *msg, grub_uint32_t **unicode_msg,
 {
   grub_size_t msg_len = grub_strlen (msg);
 
-  *unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t));
+  *unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t));
  
   if (!*unicode_msg)
     return -1;
@@ -488,7 +488,7 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen,
 	    }
 	  else
 	    {
-	      n = grub_malloc (sizeof (n[0]) * (out->ncomb + 1));
+	      n = grub_calloc (out->ncomb + 1, sizeof (n[0]));
 	      if (!n)
 		{
 		  grub_errno = GRUB_ERR_NONE;
@@ -842,7 +842,7 @@ grub_bidi_line_logical_to_visual (const grub_uint32_t *logical,
       }							\
   }
 
-  visual = grub_malloc (sizeof (visual[0]) * logical_len);
+  visual = grub_calloc (logical_len, sizeof (visual[0]));
   if (!visual)
     return -1;
 
@@ -1165,8 +1165,8 @@ grub_bidi_logical_to_visual (const grub_uint32_t *logical,
 {
   const grub_uint32_t *line_start = logical, *ptr;
   struct grub_unicode_glyph *visual_ptr;
-  *visual_out = visual_ptr = grub_malloc (3 * sizeof (visual_ptr[0])
-					  * (logical_len + 2));
+  *visual_out = visual_ptr = grub_calloc (logical_len + 2,
+					  3 * sizeof (visual_ptr[0]));
   if (!visual_ptr)
     return -1;
   for (ptr = logical; ptr <= logical + logical_len; ptr++)
diff --git a/grub-core/normal/cmdline.c b/grub-core/normal/cmdline.c
index c037d5050..c57242e2e 100644
--- a/grub-core/normal/cmdline.c
+++ b/grub-core/normal/cmdline.c
@@ -41,7 +41,7 @@ grub_err_t
 grub_set_history (int newsize)
 {
   grub_uint32_t **old_hist_lines = hist_lines;
-  hist_lines = grub_malloc (sizeof (grub_uint32_t *) * newsize);
+  hist_lines = grub_calloc (newsize, sizeof (grub_uint32_t *));
 
   /* Copy the old lines into the new buffer.  */
   if (old_hist_lines)
@@ -114,7 +114,7 @@ static void
 grub_history_set (int pos, grub_uint32_t *s, grub_size_t len)
 {
   grub_free (hist_lines[pos]);
-  hist_lines[pos] = grub_malloc ((len + 1) * sizeof (grub_uint32_t));
+  hist_lines[pos] = grub_calloc (len + 1, sizeof (grub_uint32_t));
   if (!hist_lines[pos])
     {
       grub_print_error ();
@@ -349,7 +349,7 @@ grub_cmdline_get (const char *prompt_translated)
   char *ret;
   unsigned nterms;
 
-  buf = grub_malloc (max_len * sizeof (grub_uint32_t));
+  buf = grub_calloc (max_len, sizeof (grub_uint32_t));
   if (!buf)
     return 0;
 
@@ -377,7 +377,7 @@ grub_cmdline_get (const char *prompt_translated)
     FOR_ACTIVE_TERM_OUTPUTS(cur)
       nterms++;
 
-    cl_terms = grub_malloc (sizeof (cl_terms[0]) * nterms);
+    cl_terms = grub_calloc (nterms, sizeof (cl_terms[0]));
     if (!cl_terms)
       {
 	grub_free (buf);
@@ -385,7 +385,7 @@ grub_cmdline_get (const char *prompt_translated)
       }
     cl_term_cur = cl_terms;
 
-    unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t));
+    unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t));
     if (!unicode_msg)
       {
 	grub_free (buf);
@@ -495,7 +495,7 @@ grub_cmdline_get (const char *prompt_translated)
 		grub_uint32_t *insert;
 
 		insertlen = grub_strlen (insertu8);
-		insert = grub_malloc ((insertlen + 1) * sizeof (grub_uint32_t));
+		insert = grub_calloc (insertlen + 1, sizeof (grub_uint32_t));
 		if (!insert)
 		  {
 		    grub_free (insertu8);
@@ -602,7 +602,7 @@ grub_cmdline_get (const char *prompt_translated)
 
 	      grub_free (kill_buf);
 
-	      kill_buf = grub_malloc ((n + 1) * sizeof(grub_uint32_t));
+	      kill_buf = grub_calloc (n + 1, sizeof (grub_uint32_t));
 	      if (grub_errno)
 		{
 		  grub_print_error ();
diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c
index cdf3590a3..1993995be 100644
--- a/grub-core/normal/menu_entry.c
+++ b/grub-core/normal/menu_entry.c
@@ -95,8 +95,8 @@ init_line (struct screen *screen, struct line *linep)
 {
   linep->len = 0;
   linep->max_len = 80;
-  linep->buf = grub_malloc ((linep->max_len + 1) * sizeof (linep->buf[0]));
-  linep->pos = grub_zalloc (screen->nterms * sizeof (linep->pos[0]));
+  linep->buf = grub_calloc (linep->max_len + 1, sizeof (linep->buf[0]));
+  linep->pos = grub_calloc (screen->nterms, sizeof (linep->pos[0]));
   if (! linep->buf || !linep->pos)
     {
       grub_free (linep->buf);
@@ -287,7 +287,7 @@ update_screen (struct screen *screen, struct per_term_screen *term_screen,
 	  pos = linep->pos + (term_screen - screen->terms);
 
 	  if (!*pos)
-	    *pos = grub_zalloc ((linep->len + 1) * sizeof (**pos));
+	    *pos = grub_calloc (linep->len + 1, sizeof (**pos));
 
 	  if (i == region_start || linep == screen->lines + screen->line
 	      || (i > region_start && mode == ALL_LINES))
@@ -471,7 +471,7 @@ insert_string (struct screen *screen, const char *s, int update)
 
 	  /* Insert the string.  */
 	  current_linep = screen->lines + screen->line;
-	  unicode_msg = grub_malloc ((p - s) * sizeof (grub_uint32_t));
+	  unicode_msg = grub_calloc (p - s, sizeof (grub_uint32_t));
 
 	  if (!unicode_msg)
 	    return 0;
@@ -1023,7 +1023,7 @@ complete (struct screen *screen, int continuous, int update)
   if (completion_buffer.buf)
     {
       buflen = grub_strlen (completion_buffer.buf);
-      ucs4 = grub_malloc (sizeof (grub_uint32_t) * (buflen + 1));
+      ucs4 = grub_calloc (buflen + 1, sizeof (grub_uint32_t));
       
       if (!ucs4)
 	{
@@ -1268,7 +1268,7 @@ grub_menu_entry_run (grub_menu_entry_t entry)
   for (i = 0; i < (unsigned) screen->num_lines; i++)
     {
       grub_free (screen->lines[i].pos);
-      screen->lines[i].pos = grub_zalloc (screen->nterms * sizeof (screen->lines[i].pos[0]));
+      screen->lines[i].pos = grub_calloc (screen->nterms, sizeof (screen->lines[i].pos[0]));
       if (! screen->lines[i].pos)
 	{
 	  grub_print_error ();
@@ -1278,7 +1278,7 @@ grub_menu_entry_run (grub_menu_entry_t entry)
 	}
     }
 
-  screen->terms = grub_zalloc (screen->nterms * sizeof (screen->terms[0]));
+  screen->terms = grub_calloc (screen->nterms, sizeof (screen->terms[0]));
   if (!screen->terms)
     {
       grub_print_error ();
diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
index e22bb91f6..18240e76c 100644
--- a/grub-core/normal/menu_text.c
+++ b/grub-core/normal/menu_text.c
@@ -78,7 +78,7 @@ grub_print_message_indented_real (const char *msg, int margin_left,
   grub_size_t msg_len = grub_strlen (msg) + 2;
   int ret = 0;
 
-  unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t));
+  unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t));
  
   if (!unicode_msg)
     return 0;
@@ -211,7 +211,7 @@ print_entry (int y, int highlight, grub_menu_entry_t entry,
 
   title = entry ? entry->title : "";
   title_len = grub_strlen (title);
-  unicode_title = grub_malloc (title_len * sizeof (*unicode_title));
+  unicode_title = grub_calloc (title_len, sizeof (*unicode_title));
   if (! unicode_title)
     /* XXX How to show this error?  */
     return;
diff --git a/grub-core/normal/term.c b/grub-core/normal/term.c
index a1e5c5a0d..cc8c173b6 100644
--- a/grub-core/normal/term.c
+++ b/grub-core/normal/term.c
@@ -264,7 +264,7 @@ grub_term_save_pos (void)
   FOR_ACTIVE_TERM_OUTPUTS(cur)
     cnt++;
 
-  ret = grub_malloc (cnt * sizeof (ret[0]));
+  ret = grub_calloc (cnt, sizeof (ret[0]));
   if (!ret)
     return NULL;
 
@@ -1013,7 +1013,7 @@ grub_xnputs (const char *str, grub_size_t msg_len)
 
   grub_error_push ();
 
-  unicode_str = grub_malloc (msg_len * sizeof (grub_uint32_t));
+  unicode_str = grub_calloc (msg_len, sizeof (grub_uint32_t));
  
   grub_error_pop ();
 
diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c
index 6d9f4e5fa..001b818fe 100644
--- a/grub-core/osdep/linux/getroot.c
+++ b/grub-core/osdep/linux/getroot.c
@@ -168,7 +168,7 @@ grub_util_raid_getmembers (const char *name, int bootable)
   if (ret != 0)
     grub_util_error (_("ioctl GET_ARRAY_INFO error: %s"), strerror (errno));
 
-  devicelist = xmalloc ((info.nr_disks + 1) * sizeof (char *));
+  devicelist = xcalloc (info.nr_disks + 1, sizeof (char *));
 
   for (i = 0, j = 0; j < info.nr_disks; i++)
     {
@@ -241,7 +241,7 @@ grub_find_root_devices_from_btrfs (const char *dir)
       return NULL;
     }
 
-  ret = xmalloc ((fsi.num_devices + 1) * sizeof (ret[0]));
+  ret = xcalloc (fsi.num_devices + 1, sizeof (ret[0]));
 
   for (i = 1; i <= fsi.max_id && j < fsi.num_devices; i++)
     {
@@ -396,7 +396,7 @@ grub_find_root_devices_from_mountinfo (const char *dir, char **relroot)
   if (relroot)
     *relroot = NULL;
 
-  entries = xmalloc (entry_max * sizeof (*entries));
+  entries = xcalloc (entry_max, sizeof (*entries));
 
 again:
   fp = grub_util_fopen ("/proc/self/mountinfo", "r");
diff --git a/grub-core/osdep/unix/config.c b/grub-core/osdep/unix/config.c
index 65effa9f3..7d6325138 100644
--- a/grub-core/osdep/unix/config.c
+++ b/grub-core/osdep/unix/config.c
@@ -89,7 +89,7 @@ grub_util_load_config (struct grub_util_config *cfg)
   argv[0] = "sh";
   argv[1] = "-c";
 
-  script = xmalloc (4 * strlen (cfgfile) + 300);
+  script = xcalloc (4, strlen (cfgfile) + 300);
 
   ptr = script;
   memcpy (ptr, ". '", 3);
diff --git a/grub-core/osdep/windows/getroot.c b/grub-core/osdep/windows/getroot.c
index 661d95461..eada663b2 100644
--- a/grub-core/osdep/windows/getroot.c
+++ b/grub-core/osdep/windows/getroot.c
@@ -59,7 +59,7 @@ grub_get_mount_point (const TCHAR *path)
 
   for (ptr = path; *ptr; ptr++);
   allocsize = (ptr - path + 10) * 2;
-  out = xmalloc (allocsize * sizeof (out[0]));
+  out = xcalloc (allocsize, sizeof (out[0]));
 
   /* When pointing to EFI system partition GetVolumePathName fails
      for ESP root and returns abberant information for everything
diff --git a/grub-core/osdep/windows/hostdisk.c b/grub-core/osdep/windows/hostdisk.c
index 355100789..0be327394 100644
--- a/grub-core/osdep/windows/hostdisk.c
+++ b/grub-core/osdep/windows/hostdisk.c
@@ -111,7 +111,7 @@ grub_util_get_windows_path_real (const char *path)
 
   while (1)
     {
-      fpa = xmalloc (alloc * sizeof (fpa[0]));
+      fpa = xcalloc (alloc, sizeof (fpa[0]));
 
       len = GetFullPathName (tpath, alloc, fpa, NULL);
       if (len >= alloc)
@@ -399,7 +399,7 @@ grub_util_fd_opendir (const char *name)
   for (l = 0; name_windows[l]; l++);
   for (l--; l >= 0 && (name_windows[l] == '\\' || name_windows[l] == '/'); l--);
   l++;
-  pattern = xmalloc ((l + 3) * sizeof (pattern[0]));
+  pattern = xcalloc (l + 3, sizeof (pattern[0]));
   memcpy (pattern, name_windows, l * sizeof (pattern[0]));
   pattern[l] = '\\';
   pattern[l + 1] = '*';
diff --git a/grub-core/osdep/windows/init.c b/grub-core/osdep/windows/init.c
index e8ffd62c6..6297de632 100644
--- a/grub-core/osdep/windows/init.c
+++ b/grub-core/osdep/windows/init.c
@@ -161,7 +161,7 @@ grub_util_host_init (int *argc __attribute__ ((unused)),
   LPWSTR *targv;
 
   targv = CommandLineToArgvW (tcmdline, argc);
-  *argv = xmalloc ((*argc + 1) * sizeof (argv[0]));
+  *argv = xcalloc (*argc + 1, sizeof (argv[0]));
 
   for (i = 0; i < *argc; i++)
     (*argv)[i] = grub_util_tchar_to_utf8 (targv[i]); 
diff --git a/grub-core/osdep/windows/platform.c b/grub-core/osdep/windows/platform.c
index 7eb53fe01..1ef86bf58 100644
--- a/grub-core/osdep/windows/platform.c
+++ b/grub-core/osdep/windows/platform.c
@@ -225,8 +225,8 @@ grub_install_register_efi (grub_device_t efidir_grub_dev,
     grub_util_error ("%s", _("no EFI routines are available when running in BIOS mode"));
 
   distrib8_len = grub_strlen (efi_distributor);
-  distributor16 = xmalloc ((distrib8_len + 1) * GRUB_MAX_UTF16_PER_UTF8
-			   * sizeof (grub_uint16_t));
+  distributor16 = xcalloc (distrib8_len + 1,
+			   GRUB_MAX_UTF16_PER_UTF8 * sizeof (grub_uint16_t));
   distrib16_len = grub_utf8_to_utf16 (distributor16, distrib8_len * GRUB_MAX_UTF16_PER_UTF8,
 				      (const grub_uint8_t *) efi_distributor,
 				      distrib8_len, 0);
diff --git a/grub-core/osdep/windows/relpath.c b/grub-core/osdep/windows/relpath.c
index cb0861744..478e8ef14 100644
--- a/grub-core/osdep/windows/relpath.c
+++ b/grub-core/osdep/windows/relpath.c
@@ -72,7 +72,7 @@ grub_make_system_path_relative_to_its_root (const char *path)
       if (dirwindows[0] && dirwindows[1] == ':')
 	offset = 2;
     }
-  ret = xmalloc (sizeof (ret[0]) * (flen - offset + 2));
+  ret = xcalloc (flen - offset + 2, sizeof (ret[0]));
   if (dirwindows[offset] != '\\'
       && dirwindows[offset] != '/'
       && dirwindows[offset])
diff --git a/grub-core/partmap/gpt.c b/grub-core/partmap/gpt.c
index 103f6796f..72a2e37cd 100644
--- a/grub-core/partmap/gpt.c
+++ b/grub-core/partmap/gpt.c
@@ -199,7 +199,7 @@ gpt_partition_map_embed (struct grub_disk *disk, unsigned int *nsectors,
   *nsectors = ctx.len;
   if (*nsectors > max_nsectors)
     *nsectors = max_nsectors;
-  *sectors = grub_malloc (*nsectors * sizeof (**sectors));
+  *sectors = grub_calloc (*nsectors, sizeof (**sectors));
   if (!*sectors)
     return grub_errno;
   for (i = 0; i < *nsectors; i++)
diff --git a/grub-core/partmap/msdos.c b/grub-core/partmap/msdos.c
index 7b8e45076..ee3f24982 100644
--- a/grub-core/partmap/msdos.c
+++ b/grub-core/partmap/msdos.c
@@ -337,7 +337,7 @@ pc_partition_map_embed (struct grub_disk *disk, unsigned int *nsectors,
       avail_nsectors = *nsectors;
       if (*nsectors > max_nsectors)
 	*nsectors = max_nsectors;
-      *sectors = grub_malloc (*nsectors * sizeof (**sectors));
+      *sectors = grub_calloc (*nsectors, sizeof (**sectors));
       if (!*sectors)
 	return grub_errno;
       for (i = 0; i < *nsectors; i++)
diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
index 8cc61ee7d..8a9161cc8 100644
--- a/grub-core/script/execute.c
+++ b/grub-core/script/execute.c
@@ -553,7 +553,7 @@ gettext_append (struct grub_script_argv *result, const char *orig_str)
   for (iptr = orig_str; *iptr; iptr++)
     if (*iptr == '$')
       dollar_cnt++;
-  ctx.allowed_strings = grub_malloc (sizeof (ctx.allowed_strings[0]) * dollar_cnt);
+  ctx.allowed_strings = grub_calloc (dollar_cnt, sizeof (ctx.allowed_strings[0]));
 
   if (parse_string (orig_str, gettext_save_allow, &ctx, 0))
     goto fail;
diff --git a/grub-core/tests/fake_input.c b/grub-core/tests/fake_input.c
index 2d6085298..b5eb516be 100644
--- a/grub-core/tests/fake_input.c
+++ b/grub-core/tests/fake_input.c
@@ -49,7 +49,7 @@ grub_terminal_input_fake_sequence (int *seq_in, int nseq_in)
     saved = grub_term_inputs;
   if (seq)
     grub_free (seq);
-  seq = grub_malloc (nseq_in * sizeof (seq[0]));
+  seq = grub_calloc (nseq_in, sizeof (seq[0]));
   if (!seq)
     return;
 
diff --git a/grub-core/tests/video_checksum.c b/grub-core/tests/video_checksum.c
index 74d5b65e5..44d081069 100644
--- a/grub-core/tests/video_checksum.c
+++ b/grub-core/tests/video_checksum.c
@@ -336,7 +336,7 @@ grub_video_capture_write_bmp (const char *fname,
     {
     case 4:
       {
-	grub_uint8_t *buffer = xmalloc (mode_info->width * 3);
+	grub_uint8_t *buffer = xcalloc (3, mode_info->width);
 	grub_uint32_t rmask = ((1 << mode_info->red_mask_size) - 1);
 	grub_uint32_t gmask = ((1 << mode_info->green_mask_size) - 1);
 	grub_uint32_t bmask = ((1 << mode_info->blue_mask_size) - 1);
@@ -367,7 +367,7 @@ grub_video_capture_write_bmp (const char *fname,
       }
     case 3:
       {
-	grub_uint8_t *buffer = xmalloc (mode_info->width * 3);
+	grub_uint8_t *buffer = xcalloc (3, mode_info->width);
 	grub_uint32_t rmask = ((1 << mode_info->red_mask_size) - 1);
 	grub_uint32_t gmask = ((1 << mode_info->green_mask_size) - 1);
 	grub_uint32_t bmask = ((1 << mode_info->blue_mask_size) - 1);
@@ -407,7 +407,7 @@ grub_video_capture_write_bmp (const char *fname,
       }
     case 2:
       {
-	grub_uint8_t *buffer = xmalloc (mode_info->width * 3);
+	grub_uint8_t *buffer = xcalloc (3, mode_info->width);
 	grub_uint16_t rmask = ((1 << mode_info->red_mask_size) - 1);
 	grub_uint16_t gmask = ((1 << mode_info->green_mask_size) - 1);
 	grub_uint16_t bmask = ((1 << mode_info->blue_mask_size) - 1);
diff --git a/grub-core/video/capture.c b/grub-core/video/capture.c
index 4f83c7441..4d3195e01 100644
--- a/grub-core/video/capture.c
+++ b/grub-core/video/capture.c
@@ -89,7 +89,7 @@ grub_video_capture_start (const struct grub_video_mode_info *mode_info,
   framebuffer.mode_info = *mode_info;
   framebuffer.mode_info.blit_format = grub_video_get_blit_format (&framebuffer.mode_info);
 
-  framebuffer.ptr = grub_malloc (framebuffer.mode_info.height * framebuffer.mode_info.pitch);
+  framebuffer.ptr = grub_calloc (framebuffer.mode_info.height, framebuffer.mode_info.pitch);
   if (!framebuffer.ptr)
     return grub_errno;
   
diff --git a/grub-core/video/emu/sdl.c b/grub-core/video/emu/sdl.c
index a2f639f66..0ebab6f57 100644
--- a/grub-core/video/emu/sdl.c
+++ b/grub-core/video/emu/sdl.c
@@ -172,7 +172,7 @@ grub_video_sdl_set_palette (unsigned int start, unsigned int count,
       if (start + count > mode_info.number_of_colors)
 	count = mode_info.number_of_colors - start;
 
-      tmp = grub_malloc (count * sizeof (tmp[0]));
+      tmp = grub_calloc (count, sizeof (tmp[0]));
       for (i = 0; i < count; i++)
 	{
 	  tmp[i].r = palette_data[i].r;
diff --git a/grub-core/video/i386/pc/vga.c b/grub-core/video/i386/pc/vga.c
index 01f47112d..b2f776c99 100644
--- a/grub-core/video/i386/pc/vga.c
+++ b/grub-core/video/i386/pc/vga.c
@@ -127,7 +127,7 @@ grub_video_vga_setup (unsigned int width, unsigned int height,
 
   vga_height = height ? : 480;
 
-  framebuffer.temporary_buffer = grub_malloc (vga_height * VGA_WIDTH);
+  framebuffer.temporary_buffer = grub_calloc (vga_height, VGA_WIDTH);
   framebuffer.front_page = 0;
   framebuffer.back_page = 0;
   if (!framebuffer.temporary_buffer)
diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
index 777e71334..61bd64537 100644
--- a/grub-core/video/readers/png.c
+++ b/grub-core/video/readers/png.c
@@ -309,7 +309,7 @@ grub_png_decode_image_header (struct grub_png_data *data)
   if (data->is_16bit || data->is_gray || data->is_palette)
 #endif
     {
-      data->image_data = grub_malloc (data->image_height * data->row_bytes);
+      data->image_data = grub_calloc (data->image_height, data->row_bytes);
       if (grub_errno)
         return grub_errno;
 
diff --git a/include/grub/unicode.h b/include/grub/unicode.h
index a0403e91f..4de986a85 100644
--- a/include/grub/unicode.h
+++ b/include/grub/unicode.h
@@ -293,7 +293,7 @@ grub_unicode_glyph_dup (const struct grub_unicode_glyph *in)
   grub_memcpy (out, in, sizeof (*in));
   if (in->ncomb > ARRAY_SIZE (out->combining_inline))
     {
-      out->combining_ptr = grub_malloc (in->ncomb * sizeof (out->combining_ptr[0]));
+      out->combining_ptr = grub_calloc (in->ncomb, sizeof (out->combining_ptr[0]));
       if (!out->combining_ptr)
 	{
 	  grub_free (out);
@@ -315,7 +315,7 @@ grub_unicode_set_glyph (struct grub_unicode_glyph *out,
   grub_memcpy (out, in, sizeof (*in));
   if (in->ncomb > ARRAY_SIZE (out->combining_inline))
     {
-      out->combining_ptr = grub_malloc (in->ncomb * sizeof (out->combining_ptr[0]));
+      out->combining_ptr = grub_calloc (in->ncomb, sizeof (out->combining_ptr[0]));
       if (!out->combining_ptr)
 	return;
       grub_memcpy (out->combining_ptr, in->combining_ptr,
diff --git a/util/getroot.c b/util/getroot.c
index 847406fba..a5eaa64fd 100644
--- a/util/getroot.c
+++ b/util/getroot.c
@@ -200,7 +200,7 @@ make_device_name (const char *drive)
   char *ret, *ptr;
   const char *iptr;
 
-  ret = xmalloc (strlen (drive) * 2);
+  ret = xcalloc (2, strlen (drive));
   ptr = ret;
   for (iptr = drive; *iptr; iptr++)
     {
diff --git a/util/grub-file.c b/util/grub-file.c
index 50c18b683..b2e7dd69f 100644
--- a/util/grub-file.c
+++ b/util/grub-file.c
@@ -54,7 +54,7 @@ main (int argc, char *argv[])
 
   grub_util_host_init (&argc, &argv);
 
-  argv2 = xmalloc (argc * sizeof (argv2[0]));
+  argv2 = xcalloc (argc, sizeof (argv2[0]));
 
   if (argc == 2 && strcmp (argv[1], "--version") == 0)
     {
diff --git a/util/grub-fstest.c b/util/grub-fstest.c
index 7f14620cd..838656420 100644
--- a/util/grub-fstest.c
+++ b/util/grub-fstest.c
@@ -650,7 +650,7 @@ argp_parser (int key, char *arg, struct argp_state *state)
   if (args_count < num_disks)
     {
       if (args_count == 0)
-	images = xmalloc (num_disks * sizeof (images[0]));
+	images = xcalloc (num_disks, sizeof (images[0]));
       images[args_count] = grub_canonicalize_file_name (arg);
       args_count++;
       return 0;
@@ -734,7 +734,7 @@ main (int argc, char *argv[])
 
   grub_util_host_init (&argc, &argv);
 
-  args = xmalloc (argc * sizeof (args[0]));
+  args = xcalloc (argc, sizeof (args[0]));
 
   argp_parse (&argp, argc, argv, 0, 0, 0);
 
diff --git a/util/grub-install-common.c b/util/grub-install-common.c
index ca0ac612a..0295d40f5 100644
--- a/util/grub-install-common.c
+++ b/util/grub-install-common.c
@@ -286,7 +286,7 @@ handle_install_list (struct install_list *il, const char *val,
       il->n_entries++;
     }
   il->n_alloc = il->n_entries + 1;
-  il->entries = xmalloc (il->n_alloc * sizeof (il->entries[0]));
+  il->entries = xcalloc (il->n_alloc, sizeof (il->entries[0]));
   ptr = val;
   for (ce = il->entries; ; ce++)
     {
diff --git a/util/grub-install.c b/util/grub-install.c
index 8970b73aa..a35a2e2e8 100644
--- a/util/grub-install.c
+++ b/util/grub-install.c
@@ -634,7 +634,7 @@ device_map_check_duplicates (const char *dev_map)
   if (! fp)
     return;
 
-  d = xmalloc (alloced * sizeof (d[0]));
+  d = xcalloc (alloced, sizeof (d[0]));
 
   while (fgets (buf, sizeof (buf), fp))
     {
@@ -1268,7 +1268,7 @@ main (int argc, char *argv[])
       ndev++;
     }
 
-  grub_drives = xmalloc (sizeof (grub_drives[0]) * (ndev + 1)); 
+  grub_drives = xcalloc (ndev + 1, sizeof (grub_drives[0]));
 
   for (curdev = grub_devices, curdrive = grub_drives; *curdev; curdev++,
        curdrive++)
diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
index ab6dfab79..00f49ccaa 100644
--- a/util/grub-mkimagexx.c
+++ b/util/grub-mkimagexx.c
@@ -2294,10 +2294,8 @@ SUFFIX (grub_mkimage_load_image) (const char *kernel_path,
 		      + grub_host_to_target16 (e->e_shstrndx) * smd.section_entsize);
   smd.strtab = (char *) e + grub_host_to_target_addr (s->sh_offset);
 
-  smd.addrs = xmalloc (sizeof (*smd.addrs) * smd.num_sections);
-  memset (smd.addrs, 0, sizeof (*smd.addrs) * smd.num_sections);
-  smd.vaddrs = xmalloc (sizeof (*smd.vaddrs) * smd.num_sections);
-  memset (smd.vaddrs, 0, sizeof (*smd.vaddrs) * smd.num_sections);
+  smd.addrs = xcalloc (smd.num_sections, sizeof (*smd.addrs));
+  smd.vaddrs = xcalloc (smd.num_sections, sizeof (*smd.vaddrs));
 
   SUFFIX (locate_sections) (e, kernel_path, &smd, layout, image_target);
 
diff --git a/util/grub-mkrescue.c b/util/grub-mkrescue.c
index ce2cbc4f1..51831027f 100644
--- a/util/grub-mkrescue.c
+++ b/util/grub-mkrescue.c
@@ -441,8 +441,8 @@ main (int argc, char *argv[])
   xorriso = xstrdup ("xorriso");
   label_font = grub_util_path_concat (2, pkgdatadir, "unicode.pf2");
 
-  argp_argv = xmalloc (sizeof (argp_argv[0]) * argc);
-  xorriso_tail_argv = xmalloc (sizeof (argp_argv[0]) * argc);
+  argp_argv = xcalloc (argc, sizeof (argp_argv[0]));
+  xorriso_tail_argv = xcalloc (argc, sizeof (argp_argv[0]));
 
   xorriso_tail_argc = 0;
   /* Program name */
diff --git a/util/grub-mkstandalone.c b/util/grub-mkstandalone.c
index 4907d44c0..edf309717 100644
--- a/util/grub-mkstandalone.c
+++ b/util/grub-mkstandalone.c
@@ -296,7 +296,7 @@ main (int argc, char *argv[])
   grub_util_host_init (&argc, &argv);
   grub_util_disable_fd_syncs ();
 
-  files = xmalloc ((argc + 1) * sizeof (files[0]));
+  files = xcalloc (argc + 1, sizeof (files[0]));
 
   argp_parse (&argp, argc, argv, 0, 0, 0);
 
diff --git a/util/grub-pe2elf.c b/util/grub-pe2elf.c
index 0d4084a10..11331294f 100644
--- a/util/grub-pe2elf.c
+++ b/util/grub-pe2elf.c
@@ -100,9 +100,9 @@ write_section_data (FILE* fp, const char *name, char *image,
   char *pe_strtab = (image + pe_chdr->symtab_offset
 		     + pe_chdr->num_symbols * sizeof (struct grub_pe32_symbol));
 
-  section_map = xmalloc ((2 * pe_chdr->num_sections + 5) * sizeof (int));
+  section_map = xcalloc (2 * pe_chdr->num_sections + 5, sizeof (int));
   section_map[0] = 0;
-  shdr = xmalloc ((2 * pe_chdr->num_sections + 5) * sizeof (shdr[0]));
+  shdr = xcalloc (2 * pe_chdr->num_sections + 5, sizeof (shdr[0]));
   idx = 1;
   idx_reloc = pe_chdr->num_sections + 1;
 
@@ -233,7 +233,7 @@ write_reloc_section (FILE* fp, const char *name, char *image,
 
       pe_sec = pe_shdr + shdr[i].sh_link;
       pe_rel = (struct grub_pe32_reloc *) (image + pe_sec->relocations_offset);
-      rel = (elf_reloc_t *) xmalloc (pe_sec->num_relocations * sizeof (elf_reloc_t));
+      rel = (elf_reloc_t *) xcalloc (pe_sec->num_relocations, sizeof (elf_reloc_t));
       num_rels = 0;
       modified = 0;
 
@@ -365,12 +365,10 @@ write_symbol_table (FILE* fp, const char *name, char *image,
   pe_symtab = (struct grub_pe32_symbol *) (image + pe_chdr->symtab_offset);
   pe_strtab = (char *) (pe_symtab + pe_chdr->num_symbols);
 
-  symtab = (Elf_Sym *) xmalloc ((pe_chdr->num_symbols + 1) *
-				sizeof (Elf_Sym));
-  memset (symtab, 0, (pe_chdr->num_symbols + 1) * sizeof (Elf_Sym));
+  symtab = (Elf_Sym *) xcalloc (pe_chdr->num_symbols + 1, sizeof (Elf_Sym));
   num_syms = 1;
 
-  symtab_map = (int *) xmalloc (pe_chdr->num_symbols * sizeof (int));
+  symtab_map = (int *) xcalloc (pe_chdr->num_symbols, sizeof (int));
 
   for (i = 0; i < (int) pe_chdr->num_symbols;
        i += pe_symtab->num_aux + 1, pe_symtab += pe_symtab->num_aux + 1)
diff --git a/util/grub-probe.c b/util/grub-probe.c
index 81d27eead..cbe6ed94c 100644
--- a/util/grub-probe.c
+++ b/util/grub-probe.c
@@ -361,8 +361,8 @@ probe (const char *path, char **device_names, char delim)
       grub_util_pull_device (*curdev);
       ndev++;
     }
-  
-  drives_names = xmalloc (sizeof (drives_names[0]) * (ndev + 1)); 
+
+  drives_names = xcalloc (ndev + 1, sizeof (drives_names[0]));
 
   for (curdev = device_names, curdrive = drives_names; *curdev; curdev++,
        curdrive++)
-- 
2.11.0



  parent reply	other threads:[~2020-07-29 17:01 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-29 17:00 [SECURITY PATCH 00/28] Multiple GRUB2 vulnerabilities - BootHole Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 01/28] yylex: Make lexer fatal errors actually be fatal Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 02/28] safemath: Add some arithmetic primitives that check for overflow Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 03/28] calloc: Make sure we always have an overflow-checking calloc() available Daniel Kiper
2020-07-29 17:00 ` Daniel Kiper [this message]
2020-07-29 17:00 ` [SECURITY PATCH 05/28] malloc: Use overflow checking primitives where we do complex allocations Daniel Kiper
2021-09-10 16:10   ` Glenn Washburn
2020-07-29 17:00 ` [SECURITY PATCH 06/28] iso9660: Don't leak memory on realloc() failures Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 07/28] font: Do not load more than one NAME section Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 08/28] gfxmenu: Fix double free in load_image() Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 09/28] xnu: Fix double free in grub_xnu_devprop_add_property() Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 10/28] json: Avoid a double-free when parsing fails Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 11/28] lzma: Make sure we don't dereference past array Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 12/28] term: Fix overflow on user inputs Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 13/28] udf: Fix memory leak Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 14/28] multiboot2: Fix memory leak if grub_create_loader_cmdline() fails Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 15/28] tftp: Do not use priority queue Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 16/28] relocator: Protect grub_relocator_alloc_chunk_addr() input args against integer underflow/overflow Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 17/28] relocator: Protect grub_relocator_alloc_chunk_align() max_addr against integer underflow Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 18/28] script: Remove unused fields from grub_script_function struct Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 19/28] script: Avoid a use-after-free when redefining a function during execution Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 20/28] relocator: Fix grub_relocator_alloc_chunk_align() top memory allocation Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 21/28] hfsplus: Fix two more overflows Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 22/28] lvm: Fix two more potential data-dependent alloc overflows Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 23/28] emu: Make grub_free(NULL) safe Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 24/28] efi: Fix some malformed device path arithmetic errors Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 25/28] efi/chainloader: Propagate errors from copy_file_path() Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 26/28] efi: Fix use-after-free in halt/reboot path Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 27/28] loader/linux: Avoid overflow on initrd size calculation Daniel Kiper
2020-07-29 17:00 ` [SECURITY PATCH 28/28] linux: Fix integer overflows in initrd size handling Daniel Kiper
2020-07-29 20:12 ` [SECURITY PATCH 00/28] Multiple GRUB2 vulnerabilities - BootHole Christian Hesse
2020-07-29 20:20   ` John Paul Adrian Glaubitz
2020-07-29 21:20     ` Dimitri John Ledkov
2020-07-29 21:33       ` John Paul Adrian Glaubitz

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200729170041.14082-5-daniel.kiper@oracle.com \
    --to=daniel.kiper@oracle.com \
    --cc=93sam@debian.org \
    --cc=alexander.burmashev@oracle.com \
    --cc=amakhalov@vmware.com \
    --cc=chris.coulson@canonical.com \
    --cc=cjwatson@debian.org \
    --cc=cperry@redhat.com \
    --cc=darren.kenny@oracle.com \
    --cc=darren.moffat@oracle.com \
    --cc=dave.miner@oracle.com \
    --cc=degranit@microsoft.com \
    --cc=eric.snowberg@oracle.com \
    --cc=grub-devel@gnu.org \
    --cc=ilya.okomin@oracle.com \
    --cc=jan.setjeeilers@oracle.com \
    --cc=jerecox@microsoft.com \
    --cc=jesse@eclypsium.com \
    --cc=john.haxby@oracle.com \
    --cc=kanth.ghatraju@oracle.com \
    --cc=konrad.wilk@oracle.com \
    --cc=mbenatto@redhat.com \
    --cc=mickey@eclypsium.com \
    --cc=msrc57813grub@microsoft.com \
    --cc=phcoder@gmail.com \
    --cc=pjones@redhat.com \
    --cc=sajacobu@microsoft.com \
    --cc=todd.vierling@oracle.com \
    --cc=xnox@ubuntu.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.