From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001

From: Peter Jones <pjones@redhat.com>

Date: Mon, 15 Jun 2020 12:26:01 -0400

Subject: [PATCH] calloc: Use calloc() at most places

This modifies most of the places we do some form of:

  X = malloc(Y * Z);

to use calloc(Y, Z) instead.

Among other issues, this fixes:

  - allocation of integer overflow in grub_png_decode_image_header()

    reported by Chris Coulson,

  - allocation of integer overflow in luks_recover_key()

    reported by Chris Coulson,

  - allocation of integer overflow in grub_lvm_detect()

    reported by Chris Coulson.

Fixes: CVE-2020-14308

Signed-off-by: Peter Jones <pjones@redhat.com>

Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

Upstream-commit-id: 48eeedf1e4b

---

 grub-core/bus/usb/usbhub.c                |  8 +++---

 grub-core/commands/efi/lsefisystab.c      |  3 ++-

 grub-core/commands/legacycfg.c            |  6 ++---

 grub-core/commands/menuentry.c            |  2 +-

 grub-core/commands/nativedisk.c           |  2 +-

 grub-core/commands/parttool.c             | 12 ++++++---

 grub-core/commands/regexp.c               |  2 +-

 grub-core/commands/search_wrap.c          |  2 +-

 grub-core/disk/diskfilter.c               |  4 +--

 grub-core/disk/ieee1275/ofdisk.c          |  2 +-

 grub-core/disk/ldm.c                      | 14 +++++-----

 grub-core/disk/luks.c                     |  2 +-

 grub-core/disk/lvm.c                      |  8 +++---

 grub-core/disk/xen/xendisk.c              |  2 +-

 grub-core/efiemu/loadcore.c               |  2 +-

 grub-core/efiemu/mm.c                     |  6 ++---

 grub-core/font/font.c                     |  3 +--

 grub-core/fs/affs.c                       |  6 ++---

 grub-core/fs/btrfs.c                      |  4 +--

 grub-core/fs/hfs.c                        |  2 +-

 grub-core/fs/hfsplus.c                    | 45 ++++++++++++++++++++-----------

 grub-core/fs/iso9660.c                    |  2 +-

 grub-core/fs/ntfs.c                       |  4 +--

 grub-core/fs/sfs.c                        |  2 +-

 grub-core/fs/tar.c                        |  2 +-

 grub-core/fs/udf.c                        |  4 +--

 grub-core/fs/zfs/zfs.c                    |  4 +--

 grub-core/gfxmenu/gui_string_util.c       |  2 +-

 grub-core/gfxmenu/widget-box.c            |  4 +--

 grub-core/io/gzio.c                       |  2 +-

 grub-core/kern/efi/efi.c                  | 33 ++++++++++++++++++-----

 grub-core/kern/emu/hostdisk.c             |  2 +-

 grub-core/kern/fs.c                       |  2 +-

 grub-core/kern/misc.c                     |  2 +-

 grub-core/kern/parser.c                   |  2 +-

 grub-core/kern/uboot/uboot.c              |  2 +-

 grub-core/lib/libgcrypt/cipher/ac.c       |  8 +++---

 grub-core/lib/libgcrypt/cipher/primegen.c |  4 +--

 grub-core/lib/libgcrypt/cipher/pubkey.c   |  4 +--

 grub-core/lib/priority_queue.c            |  2 +-

 grub-core/lib/reed_solomon.c              |  7 +++--

 grub-core/lib/relocator.c                 | 10 +++----

 grub-core/loader/arm/linux.c              |  2 +-

 grub-core/loader/efi/chainloader.c        | 11 +++++---

 grub-core/loader/i386/bsdXX.c             |  2 +-

 grub-core/loader/i386/xnu.c               |  4 +--

 grub-core/loader/macho.c                  |  2 +-

 grub-core/loader/multiboot_elfxx.c        |  2 +-

 grub-core/loader/xnu.c                    |  2 +-

 grub-core/mmap/mmap.c                     |  4 +--

 grub-core/net/bootp.c                     |  2 +-

 grub-core/net/dns.c                       | 10 +++----

 grub-core/net/net.c                       |  4 +--

 grub-core/normal/charset.c                | 10 +++----

 grub-core/normal/cmdline.c                | 14 +++++-----

 grub-core/normal/menu_entry.c             | 14 +++++-----

 grub-core/normal/menu_text.c              |  4 +--

 grub-core/normal/term.c                   |  4 +--

 grub-core/osdep/linux/getroot.c           |  6 ++---

 grub-core/osdep/unix/config.c             |  2 +-

 grub-core/osdep/windows/getroot.c         |  2 +-

 grub-core/osdep/windows/hostdisk.c        |  4 +--

 grub-core/osdep/windows/init.c            |  2 +-

 grub-core/osdep/windows/platform.c        |  4 +--

 grub-core/osdep/windows/relpath.c         |  2 +-

 grub-core/partmap/gpt.c                   |  2 +-

 grub-core/partmap/msdos.c                 |  2 +-

 grub-core/script/execute.c                |  2 +-

 grub-core/tests/fake_input.c              |  2 +-

 grub-core/tests/video_checksum.c          |  6 ++---

 grub-core/video/capture.c                 |  2 +-

 grub-core/video/emu/sdl.c                 |  2 +-

 grub-core/video/i386/pc/vga.c             |  2 +-

 grub-core/video/readers/png.c             |  2 +-

 util/getroot.c                            |  2 +-

 util/grub-file.c                          |  2 +-

 util/grub-fstest.c                        |  4 +--

 util/grub-install-common.c                |  2 +-

 util/grub-install.c                       |  4 +--

 util/grub-mkimagexx.c                     |  6 ++---

 util/grub-mkrescue.c                      |  4 +--

 util/grub-mkstandalone.c                  |  2 +-

 util/grub-pe2elf.c                        | 12 ++++-----

 util/grub-probe.c                         |  4 +--

 include/grub/unicode.h                    |  4 +--

 85 files changed, 231 insertions(+), 191 deletions(-)

diff --git a/grub-core/bus/usb/usbhub.c b/grub-core/bus/usb/usbhub.c

index 34a7ff1b5f8..a06cce302d2 100644

--- a/grub-core/bus/usb/usbhub.c

+++ b/grub-core/bus/usb/usbhub.c

@@ -149,8 +149,8 @@ grub_usb_add_hub (grub_usb_device_t dev)

   grub_usb_set_configuration (dev, 1);

   dev->nports = hubdesc.portcnt;

-  dev->children = grub_zalloc (hubdesc.portcnt * sizeof (dev->children[0]));

-  dev->ports = grub_zalloc (dev->nports * sizeof (dev->ports[0]));

+  dev->children = grub_calloc (hubdesc.portcnt, sizeof (dev->children[0]));

+  dev->ports = grub_calloc (dev->nports, sizeof (dev->ports[0]));

   if (!dev->children || !dev->ports)

     {

       grub_free (dev->children);

@@ -268,8 +268,8 @@ grub_usb_controller_dev_register_iter (grub_usb_controller_t controller, void *d

   /* Query the number of ports the root Hub has.  */

   hub->nports = controller->dev->hubports (controller);

-  hub->devices = grub_zalloc (sizeof (hub->devices[0]) * hub->nports);

-  hub->ports = grub_zalloc (sizeof (hub->ports[0]) * hub->nports);

+  hub->devices = grub_calloc (hub->nports, sizeof (hub->devices[0]));

+  hub->ports = grub_calloc (hub->nports, sizeof (hub->ports[0]));

   if (!hub->devices || !hub->ports)

     {

       grub_free (hub->devices);

diff --git a/grub-core/commands/efi/lsefisystab.c b/grub-core/commands/efi/lsefisystab.c

index df103022188..cd81507f5d4 100644

--- a/grub-core/commands/efi/lsefisystab.c

+++ b/grub-core/commands/efi/lsefisystab.c

@@ -71,7 +71,8 @@ grub_cmd_lsefisystab (struct grub_command *cmd __attribute__ ((unused)),

     grub_printf ("Vendor: ");

     for (vendor_utf16 = st->firmware_vendor; *vendor_utf16; vendor_utf16++);

-    vendor = grub_malloc (4 * (vendor_utf16 - st->firmware_vendor) + 1);

+    /* Allocate extra 3 bytes to simplify math. */

+    vendor = grub_calloc (4, vendor_utf16 - st->firmware_vendor + 1);

     if (!vendor)

       return grub_errno;

     *grub_utf16_to_utf8 ((grub_uint8_t *) vendor, st->firmware_vendor,

diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c

index f9d7627bdc3..da66a8927c4 100644

--- a/grub-core/commands/legacycfg.c

+++ b/grub-core/commands/legacycfg.c

@@ -314,7 +314,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)),

   if (argc < 2)

     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

-  cutargs = grub_malloc (sizeof (cutargs[0]) * (argc - 1));

+  cutargs = grub_calloc (argc - 1, sizeof (cutargs[0]));

   if (!cutargs)

     return grub_errno;

   cutargc = argc - 1;

@@ -436,7 +436,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)),

 	    {

 	      char rbuf[3] = "-r";

 	      bsdargc = cutargc + 2;

-	      bsdargs = grub_malloc (sizeof (bsdargs[0]) * bsdargc);

+	      bsdargs = grub_calloc (bsdargc, sizeof (bsdargs[0]));

 	      if (!bsdargs)

 		{

 		  err = grub_errno;

@@ -559,7 +559,7 @@ grub_cmd_legacy_initrdnounzip (struct grub_command *mycmd __attribute__ ((unused

 	return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("can't find command `%s'"),

 			   "module");

-      newargs = grub_malloc ((argc + 1) * sizeof (newargs[0]));

+      newargs = grub_calloc (argc + 1, sizeof (newargs[0]));

       if (!newargs)

 	return grub_errno;

       grub_memcpy (newargs + 1, args, argc * sizeof (newargs[0]));

diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c

index 7004e08ce78..4b5fcf2ce9a 100644

--- a/grub-core/commands/menuentry.c

+++ b/grub-core/commands/menuentry.c

@@ -157,7 +157,7 @@ grub_normal_add_menu_entry (int argc, const char **args,

   grub_dprintf ("menu", "menu_id:\"%s\"\n", menu_id);

   /* Save argc, args to pass as parameters to block arg later. */

-  menu_args = grub_malloc (sizeof (char*) * (argc + 1));

+  menu_args = grub_calloc (argc + 1, sizeof (char *));

   if (! menu_args)

     goto fail;

diff --git a/grub-core/commands/nativedisk.c b/grub-core/commands/nativedisk.c

index 2f56a870e68..d69214f6de0 100644

--- a/grub-core/commands/nativedisk.c

+++ b/grub-core/commands/nativedisk.c

@@ -194,7 +194,7 @@ grub_cmd_nativedisk (grub_command_t cmd __attribute__ ((unused)),

   else

     path_prefix = prefix;

-  mods = grub_malloc (argc * sizeof (mods[0]));

+  mods = grub_calloc (argc, sizeof (mods[0]));

   if (!mods)

     return grub_errno;

diff --git a/grub-core/commands/parttool.c b/grub-core/commands/parttool.c

index 693e2cb42fc..36dadc0b1db 100644

--- a/grub-core/commands/parttool.c

+++ b/grub-core/commands/parttool.c

@@ -59,7 +59,13 @@ grub_parttool_register(const char *part_name,

   for (nargs = 0; args[nargs].name != 0; nargs++);

   cur->nargs = nargs;

   cur->args = (struct grub_parttool_argdesc *)

-    grub_malloc ((nargs + 1) * sizeof (struct grub_parttool_argdesc));

+    grub_calloc (nargs + 1, sizeof (struct grub_parttool_argdesc));

+  if (!cur->args)

+    {

+      grub_free (cur);

+      curhandle--;

+      return -1;

+    }

   grub_memcpy (cur->args, args,

 	       (nargs + 1) * sizeof (struct grub_parttool_argdesc));

@@ -257,7 +263,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),

 	return err;

       }

-  parsed = (int *) grub_zalloc (argc * sizeof (int));

+  parsed = (int *) grub_calloc (argc, sizeof (int));

   for (i = 1; i < argc; i++)

     if (! parsed[i])

@@ -290,7 +296,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),

 	  }

 	ptool = cur;

 	pargs = (struct grub_parttool_args *)

-	  grub_zalloc (ptool->nargs * sizeof (struct grub_parttool_args));

+	  grub_calloc (ptool->nargs, sizeof (struct grub_parttool_args));

 	for (j = i; j < argc; j++)

 	  if (! parsed[j])

 	    {

diff --git a/grub-core/commands/regexp.c b/grub-core/commands/regexp.c

index f00b184c81e..4019164f365 100644

--- a/grub-core/commands/regexp.c

+++ b/grub-core/commands/regexp.c

@@ -116,7 +116,7 @@ grub_cmd_regexp (grub_extcmd_context_t ctxt, int argc, char **args)

   if (ret)

     goto fail;

-  matches = grub_zalloc (sizeof (*matches) * (regex.re_nsub + 1));

+  matches = grub_calloc (regex.re_nsub + 1, sizeof (*matches));

   if (! matches)

     goto fail;

diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c

index d7fd26b9405..47fc8eb9966 100644

--- a/grub-core/commands/search_wrap.c

+++ b/grub-core/commands/search_wrap.c

@@ -122,7 +122,7 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args)

     for (i = 0; state[SEARCH_HINT_BAREMETAL].args[i]; i++)

       nhints++;

-  hints = grub_malloc (sizeof (hints[0]) * nhints);

+  hints = grub_calloc (nhints, sizeof (hints[0]));

   if (!hints)

     return grub_errno;

   j = 0;

diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c

index 6f901c0adf7..2be019269b1 100644

--- a/grub-core/disk/diskfilter.c

+++ b/grub-core/disk/diskfilter.c

@@ -1134,7 +1134,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb,

   array->lvs->segments->node_count = nmemb;

   array->lvs->segments->raid_member_size = disk_size;

   array->lvs->segments->nodes

-    = grub_zalloc (nmemb * sizeof (array->lvs->segments->nodes[0]));

+    = grub_calloc (nmemb, sizeof (array->lvs->segments->nodes[0]));

   array->lvs->segments->stripe_size = stripe_size;

   for (i = 0; i < nmemb; i++)

     {

@@ -1226,7 +1226,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id,

 	  grub_partition_t p;

 	  for (p = disk->partition; p; p = p->parent)

 	    s++;

-	  pv->partmaps = xmalloc (s * sizeof (pv->partmaps[0]));

+	  pv->partmaps = xcalloc (s, sizeof (pv->partmaps[0]));

 	  s = 0;

 	  for (p = disk->partition; p; p = p->parent)

 	    pv->partmaps[s++] = xstrdup (p->partmap->name);

diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c

index 235c0fe2c76..d887d4b6eee 100644

--- a/grub-core/disk/ieee1275/ofdisk.c

+++ b/grub-core/disk/ieee1275/ofdisk.c

@@ -297,7 +297,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias)

       /* Power machines documentation specify 672 as maximum SAS disks in

          one system. Using a slightly larger value to be safe. */

       table_size = 768;

-      table = grub_malloc (table_size * sizeof (grub_uint64_t));

+      table = grub_calloc (table_size, sizeof (grub_uint64_t));

       if (!table)

         {

diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c

index 2a22d2d6c1c..e6323701ab3 100644

--- a/grub-core/disk/ldm.c

+++ b/grub-core/disk/ldm.c

@@ -323,8 +323,8 @@ make_vg (grub_disk_t disk,

 	  lv->segments->type = GRUB_DISKFILTER_MIRROR;

 	  lv->segments->node_count = 0;

 	  lv->segments->node_alloc = 8;

-	  lv->segments->nodes = grub_zalloc (sizeof (*lv->segments->nodes)

-					     * lv->segments->node_alloc);

+	  lv->segments->nodes = grub_calloc (lv->segments->node_alloc,

+					     sizeof (*lv->segments->nodes));

 	  if (!lv->segments->nodes)

 	    goto fail2;

 	  ptr = vblk[i].dynamic;

@@ -543,8 +543,8 @@ make_vg (grub_disk_t disk,

 	    {

 	      comp->segment_alloc = 8;

 	      comp->segment_count = 0;

-	      comp->segments = grub_malloc (sizeof (*comp->segments)

-					    * comp->segment_alloc);

+	      comp->segments = grub_calloc (comp->segment_alloc,

+					    sizeof (*comp->segments));

 	      if (!comp->segments)

 		goto fail2;

 	    }

@@ -590,8 +590,8 @@ make_vg (grub_disk_t disk,

 		}

 	      comp->segments->node_count = read_int (ptr + 1, *ptr);

 	      comp->segments->node_alloc = comp->segments->node_count;

-	      comp->segments->nodes = grub_zalloc (sizeof (*comp->segments->nodes)

-						   * comp->segments->node_alloc);

+	      comp->segments->nodes = grub_calloc (comp->segments->node_alloc,

+						   sizeof (*comp->segments->nodes));

 	      if (!lv->segments->nodes)

 		goto fail2;

 	    }

@@ -1017,7 +1017,7 @@ grub_util_ldm_embed (struct grub_disk *disk, unsigned int *nsectors,

       *nsectors = lv->size;

       if (*nsectors > max_nsectors)

 	*nsectors = max_nsectors;

-      *sectors = grub_malloc (*nsectors * sizeof (**sectors));

+      *sectors = grub_calloc (*nsectors, sizeof (**sectors));

       if (!*sectors)

 	return grub_errno;

       for (i = 0; i < *nsectors; i++)

diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c

index 86c50c61217..18b3a8bb1d3 100644

--- a/grub-core/disk/luks.c

+++ b/grub-core/disk/luks.c

@@ -336,7 +336,7 @@ luks_recover_key (grub_disk_t source,

 	&& grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)

       max_stripes = grub_be_to_cpu32 (header.keyblock[i].stripes);

-  split_key = grub_malloc (keysize * max_stripes);

+  split_key = grub_calloc (keysize, max_stripes);

   if (!split_key)

     return grub_errno;

diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c

index 7b265c780c3..d1df640b311 100644

--- a/grub-core/disk/lvm.c

+++ b/grub-core/disk/lvm.c

@@ -173,7 +173,7 @@ grub_lvm_detect (grub_disk_t disk,

      first one.  */

   /* Allocate buffer space for the circular worst-case scenario. */

-  metadatabuf = grub_malloc (2 * mda_size);

+  metadatabuf = grub_calloc (2, mda_size);

   if (! metadatabuf)

     goto fail;

@@ -426,7 +426,7 @@ grub_lvm_detect (grub_disk_t disk,

 #endif

 		  goto lvs_fail;

 		}

-	      lv->segments = grub_zalloc (sizeof (*seg) * lv->segment_count);

+	      lv->segments = grub_calloc (lv->segment_count, sizeof (*seg));

 	      seg = lv->segments;

 	      for (i = 0; i < lv->segment_count; i++)

@@ -483,8 +483,8 @@ grub_lvm_detect (grub_disk_t disk,

 		      if (seg->node_count != 1)

 			seg->stripe_size = grub_lvm_getvalue (&p, "stripe_size = ");

-		      seg->nodes = grub_zalloc (sizeof (*stripe)

-						* seg->node_count);

+		      seg->nodes = grub_calloc (seg->node_count,

+						sizeof (*stripe));

 		      stripe = seg->nodes;

 		      p = grub_strstr (p, "stripes = [");

diff --git a/grub-core/disk/xen/xendisk.c b/grub-core/disk/xen/xendisk.c

index b18a9238d87..c1b331edba7 100644

--- a/grub-core/disk/xen/xendisk.c

+++ b/grub-core/disk/xen/xendisk.c

@@ -426,7 +426,7 @@ grub_xendisk_init (void)

   if (!ctr)

     return;

-  virtdisks = grub_malloc (ctr * sizeof (virtdisks[0]));

+  virtdisks = grub_calloc (ctr, sizeof (virtdisks[0]));

   if (!virtdisks)

     return;

   if (grub_xenstore_dir ("device/vbd", fill, &ctr))

diff --git a/grub-core/efiemu/loadcore.c b/grub-core/efiemu/loadcore.c

index 44085ef818e..2b924623f51 100644

--- a/grub-core/efiemu/loadcore.c

+++ b/grub-core/efiemu/loadcore.c

@@ -201,7 +201,7 @@ grub_efiemu_count_symbols (const Elf_Ehdr *e)

   grub_efiemu_nelfsyms = (unsigned) s->sh_size / (unsigned) s->sh_entsize;

   grub_efiemu_elfsyms = (struct grub_efiemu_elf_sym *)

-    grub_malloc (sizeof (struct grub_efiemu_elf_sym) * grub_efiemu_nelfsyms);

+    grub_calloc (grub_efiemu_nelfsyms, sizeof (struct grub_efiemu_elf_sym));

   /* Relocators */

   for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff);

diff --git a/grub-core/efiemu/mm.c b/grub-core/efiemu/mm.c

index 52a032f7b2e..9b8e0d0ad1a 100644

--- a/grub-core/efiemu/mm.c

+++ b/grub-core/efiemu/mm.c

@@ -554,11 +554,11 @@ grub_efiemu_mmap_sort_and_uniq (void)

   /* Initialize variables*/

   grub_memset (present, 0, sizeof (int) * GRUB_EFI_MAX_MEMORY_TYPE);

   scanline_events = (struct grub_efiemu_mmap_scan *)

-    grub_malloc (sizeof (struct grub_efiemu_mmap_scan) * 2 * mmap_num);

+    grub_calloc (mmap_num, sizeof (struct grub_efiemu_mmap_scan) * 2);

   /* Number of chunks can't increase more than by factor of 2 */

   result = (grub_efi_memory_descriptor_t *)

-    grub_malloc (sizeof (grub_efi_memory_descriptor_t) * 2 * mmap_num);

+    grub_calloc (mmap_num, sizeof (grub_efi_memory_descriptor_t) * 2);

   if (!result || !scanline_events)

     {

       grub_free (result);

@@ -660,7 +660,7 @@ grub_efiemu_mm_do_alloc (void)

   /* Preallocate mmap */

   efiemu_mmap = (grub_efi_memory_descriptor_t *)

-    grub_malloc (mmap_reserved_size * sizeof (grub_efi_memory_descriptor_t));

+    grub_calloc (mmap_reserved_size, sizeof (grub_efi_memory_descriptor_t));

   if (!efiemu_mmap)

     {

       grub_efiemu_unload ();

diff --git a/grub-core/font/font.c b/grub-core/font/font.c

index 53d76a64d04..68967dc1c2b 100644

--- a/grub-core/font/font.c

+++ b/grub-core/font/font.c

@@ -293,8 +293,7 @@ load_font_index (grub_file_t file, grub_uint32_t sect_length, struct

   font->num_chars = sect_length / FONT_CHAR_INDEX_ENTRY_SIZE;

   /* Allocate the character index array.  */

-  font->char_index = grub_malloc (font->num_chars

-				  * sizeof (struct char_index_entry));

+  font->char_index = grub_calloc (font->num_chars, sizeof (struct char_index_entry));

   if (!font->char_index)

     return 1;

   font->bmp_idx = grub_malloc (0x10000 * sizeof (grub_uint16_t));

diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c

index f673897e0fd..91073795f90 100644

--- a/grub-core/fs/affs.c

+++ b/grub-core/fs/affs.c

@@ -301,7 +301,7 @@ grub_affs_read_symlink (grub_fshelp_node_t node)

       return 0;

     }

   latin1[symlink_size] = 0;

-  utf8 = grub_malloc (symlink_size * GRUB_MAX_UTF8_PER_LATIN1 + 1);

+  utf8 = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, symlink_size);

   if (!utf8)

     {

       grub_free (latin1);

@@ -422,7 +422,7 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir,

 	return 1;

     }

-  hashtable = grub_zalloc (data->htsize * sizeof (*hashtable));

+  hashtable = grub_calloc (data->htsize, sizeof (*hashtable));

   if (!hashtable)

     return 1;

@@ -628,7 +628,7 @@ grub_affs_label (grub_device_t device, char **label)

       len = file.namelen;

       if (len > sizeof (file.name))

 	len = sizeof (file.name);

-      *label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);

+      *label = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, len);

       if (*label)

 	*grub_latin1_to_utf8 ((grub_uint8_t *) *label, file.name, len) = '\0';

     }

diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c

index dac73b2fa8b..8c8aa9c3103 100644

--- a/grub-core/fs/btrfs.c

+++ b/grub-core/fs/btrfs.c

@@ -404,7 +404,7 @@ lower_bound (struct grub_btrfs_data *data,

     {

       desc->allocated = 16;

       desc->depth = 0;

-      desc->data = grub_malloc (sizeof (desc->data[0]) * desc->allocated);

+      desc->data = grub_calloc (desc->allocated, sizeof (desc->data[0]));

       if (!desc->data)

 	return grub_errno;

     }

@@ -2056,7 +2056,7 @@ grub_btrfs_embed (grub_device_t device __attribute__ ((unused)),

   *nsectors = 64 * 2 - 1;

   if (*nsectors > max_nsectors)

     *nsectors = max_nsectors;

-  *sectors = grub_malloc (*nsectors * sizeof (**sectors));

+  *sectors = grub_calloc (*nsectors, sizeof (**sectors));

   if (!*sectors)

     return grub_errno;

   for (i = 0; i < *nsectors; i++)

diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c

index fc36831789c..3fd4eec202c 100644

--- a/grub-core/fs/hfs.c

+++ b/grub-core/fs/hfs.c

@@ -1360,7 +1360,7 @@ grub_hfs_label (grub_device_t device, char **label)

       grub_size_t len = data->sblock.volname[0];

       if (len > sizeof (data->sblock.volname) - 1)

 	len = sizeof (data->sblock.volname) - 1;

-      *label = grub_malloc (len * MAX_UTF8_PER_MAC_ROMAN + 1);

+      *label = grub_calloc (MAX_UTF8_PER_MAC_ROMAN + 1, len);

       if (*label)

 	macroman_to_utf8 (*label, data->sblock.volname + 1,

 			  len + 1, 0);

diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c

index 21159e858ab..f1cd72398ec 100644

--- a/grub-core/fs/hfsplus.c

+++ b/grub-core/fs/hfsplus.c

@@ -661,6 +661,7 @@ list_nodes (void *record, void *hook_arg)

   char *filename;

   int i;

   struct grub_fshelp_node *node;

+  grub_uint16_t *keyname;

   struct grub_hfsplus_catfile *fileinfo;

   enum grub_fshelp_filetype type = GRUB_FSHELP_UNKNOWN;

   struct list_nodes_ctx *ctx = hook_arg;

@@ -719,32 +720,34 @@ list_nodes (void *record, void *hook_arg)

   if (! filename)

     return 0;

+  keyname = grub_calloc (grub_be_to_cpu16 (catkey->namelen), sizeof (*keyname));

+  if (!keyname)

+    {

+      grub_free (filename);

+      return 0;

+    }

+

   /* Make sure the byte order of the UTF16 string is correct.  */

   for (i = 0; i < grub_be_to_cpu16 (catkey->namelen); i++)

     {

-      catkey->name[i] = grub_be_to_cpu16 (catkey->name[i]);

+      keyname[i] = grub_be_to_cpu16 (catkey->name[i]);

-      if (catkey->name[i] == '/')

-	catkey->name[i] = ':';

+      if (keyname[i] == '/')

+	keyname[i] = ':';

       /* If the name is obviously invalid, skip this node.  */

-      if (catkey->name[i] == 0)

+      if (keyname[i] == 0)

 	{

 	  grub_free (filename);

+	  grub_free (keyname);

 	  return 0;

 	}

     }

-  *grub_utf16_to_utf8 ((grub_uint8_t *) filename, catkey->name,

+  *grub_utf16_to_utf8 ((grub_uint8_t *) filename, keyname,

 		       grub_be_to_cpu16 (catkey->namelen)) = '\0';

-  /* Restore the byte order to what it was previously.  */

-  for (i = 0; i < grub_be_to_cpu16 (catkey->namelen); i++)

-    {

-      if (catkey->name[i] == ':')

-	catkey->name[i] = '/';

-      catkey->name[i] = grub_be_to_cpu16 (catkey->name[i]);

-    }

+  grub_free (keyname);

   /* hfs+ is case insensitive.  */

   if (! ctx->dir->data->case_sensitive)

@@ -975,6 +978,7 @@ grub_hfsplus_label (grub_device_t device, char **label)

   grub_disk_t disk = device->disk;

   struct grub_hfsplus_catkey *catkey;

   int i, label_len;

+  grub_uint16_t *label_name;

   struct grub_hfsplus_key_internal intern;

   struct grub_hfsplus_btnode *node = NULL;

   grub_disk_addr_t ptr = 0;

@@ -1003,22 +1007,31 @@ grub_hfsplus_label (grub_device_t device, char **label)

     grub_hfsplus_btree_recptr (&data->catalog_tree, node, ptr);

   label_len = grub_be_to_cpu16 (catkey->namelen);

+  label_name = grub_calloc (label_len, sizeof (*label_name));

+  if (!label_name)

+    {

+      grub_free (node);

+      grub_free (data);

+      return grub_errno;

+    }

+

   for (i = 0; i < label_len; i++)

     {

-      catkey->name[i] = grub_be_to_cpu16 (catkey->name[i]);

+      label_name[i] = grub_be_to_cpu16 (catkey->name[i]);

       /* If the name is obviously invalid, skip this node.  */

-      if (catkey->name[i] == 0)

+      if (label_name[i] == 0)

 	return 0;

     }

-  *label = grub_malloc (label_len * GRUB_MAX_UTF8_PER_UTF16 + 1);

+  *label = grub_calloc (label_len, GRUB_MAX_UTF8_PER_UTF16 + 1);

   if (! *label)

     return grub_errno;

-  *grub_utf16_to_utf8 ((grub_uint8_t *) (*label), catkey->name,

+  *grub_utf16_to_utf8 ((grub_uint8_t *) (*label), label_name,

 		       label_len) = '\0';

+  grub_free (label_name);

   grub_free (node);

   grub_free (data);

diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c

index c9c8374bf61..092b8f409ec 100644

--- a/grub-core/fs/iso9660.c

+++ b/grub-core/fs/iso9660.c

@@ -331,7 +331,7 @@ grub_iso9660_convert_string (grub_uint8_t *us, int len)

   int i;

   grub_uint16_t t[MAX_NAMELEN / 2 + 1];

-  p = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1);

+  p = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1);

   if (! p)

     return NULL;

diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c

index 6f846886262..9827f9bb8c4 100644

--- a/grub-core/fs/ntfs.c

+++ b/grub-core/fs/ntfs.c

@@ -556,8 +556,8 @@ get_utf8 (grub_uint8_t *in, grub_size_t len)

   grub_uint16_t *tmp;

   grub_size_t i;

-  buf = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1);

-  tmp = grub_malloc (len * sizeof (tmp[0]));

+  buf = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1);

+  tmp = grub_calloc (len, sizeof (tmp[0]));

   if (!buf || !tmp)

     {

       grub_free (buf);

diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c

index 57b8d8da60b..663931717fd 100644

--- a/grub-core/fs/sfs.c

+++ b/grub-core/fs/sfs.c

@@ -266,7 +266,7 @@ grub_sfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)

       node->next_extent = node->block;

       node->cache_size = 0;

-      node->cache = grub_malloc (sizeof (node->cache[0]) * cache_size);

+      node->cache = grub_calloc (cache_size, sizeof (node->cache[0]));

       if (!node->cache)

 	{

 	  grub_errno = 0;

diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c

index 39bf197aabe..4864451e19b 100644

--- a/grub-core/fs/tar.c

+++ b/grub-core/fs/tar.c

@@ -120,7 +120,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,

 	  if (data->linkname_alloc < linksize + 1)

 	    {

 	      char *n;

-	      n = grub_malloc (2 * (linksize + 1));

+	      n = grub_calloc (2, linksize + 1);

 	      if (!n)

 		return grub_errno;

 	      grub_free (data->linkname);

diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c

index 00a16098b47..44481da7c6d 100644

--- a/grub-core/fs/udf.c

+++ b/grub-core/fs/udf.c

@@ -873,7 +873,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)

     {

       unsigned i;

       utf16len = sz - 1;

-      utf16 = grub_malloc (utf16len * sizeof (utf16[0]));

+      utf16 = grub_calloc (utf16len, sizeof (utf16[0]));

       if (!utf16)

 	return NULL;

       for (i = 0; i < utf16len; i++)

@@ -883,7 +883,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)

     {

       unsigned i;

       utf16len = (sz - 1) / 2;

-      utf16 = grub_malloc (utf16len * sizeof (utf16[0]));

+      utf16 = grub_calloc (utf16len, sizeof (utf16[0]));

       if (!utf16)

 	return NULL;

       for (i = 0; i < utf16len; i++)

diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c

index 6e1fff9e9ae..f6b95d4fb02 100644

--- a/grub-core/fs/zfs/zfs.c

+++ b/grub-core/fs/zfs/zfs.c

@@ -3325,7 +3325,7 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol,

 	}

       subvol->nkeys = 0;

       zap_iterate (&keychain_dn, 8, count_zap_keys, &ctx, data);