From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001

From: Peter Jones <pjones@redhat.com>

Date: Mon, 15 Jun 2020 12:28:27 -0400

Subject: [PATCH] malloc: Use overflow checking primitives where we do complex

 allocations

This attempts to fix the places where we do the following where

arithmetic_expr may include unvalidated data:

  X = grub_malloc(arithmetic_expr);

It accomplishes this by doing the arithmetic ahead of time using grub_add(),

grub_sub(), grub_mul() and testing for overflow before proceeding.

Among other issues, this fixes:

  - allocation of integer overflow in grub_video_bitmap_create()

    reported by Chris Coulson,

  - allocation of integer overflow in grub_png_decode_image_header()

    reported by Chris Coulson,

  - allocation of integer overflow in grub_squash_read_symlink()

    reported by Chris Coulson,

  - allocation of integer overflow in grub_ext2_read_symlink()

    reported by Chris Coulson,

  - allocation of integer overflow in read_section_as_string()

    reported by Chris Coulson.

Fixes: CVE-2020-14309, CVE-2020-14310, CVE-2020-14311

Signed-off-by: Peter Jones <pjones@redhat.com>

Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

Upstream-commit-id: 5fb2befbf04

---

 grub-core/commands/legacycfg.c | 29 +++++++++++++++++++-----

 grub-core/commands/wildcard.c  | 36 ++++++++++++++++++++++++-----

 grub-core/disk/ldm.c           | 32 ++++++++++++++++++--------

 grub-core/font/font.c          |  7 +++++-

 grub-core/fs/btrfs.c           | 29 ++++++++++++++++--------

 grub-core/fs/ext2.c            | 10 ++++++++-

 grub-core/fs/iso9660.c         | 51 +++++++++++++++++++++++++++++-------------

 grub-core/fs/sfs.c             | 27 +++++++++++++++++-----

 grub-core/fs/squash4.c         | 45 ++++++++++++++++++++++++++++---------

 grub-core/fs/udf.c             | 41 +++++++++++++++++++++------------

 grub-core/fs/xfs.c             | 11 +++++----

 grub-core/fs/zfs/zfs.c         | 22 ++++++++++++------

 grub-core/fs/zfs/zfscrypt.c    |  7 +++++-

 grub-core/lib/arg.c            | 20 +++++++++++++++--

 grub-core/loader/i386/bsd.c    |  8 ++++++-

 grub-core/net/dns.c            |  9 +++++++-

 grub-core/normal/charset.c     | 10 +++++++--

 grub-core/normal/cmdline.c     | 14 ++++++++++--

 grub-core/normal/menu_entry.c  | 13 +++++++++--

 grub-core/script/argv.c        | 16 +++++++++++--

 grub-core/script/lexer.c       | 21 ++++++++++++++---

 grub-core/video/bitmap.c       | 25 +++++++++++++--------

 grub-core/video/readers/png.c  | 13 +++++++++--

 23 files changed, 383 insertions(+), 113 deletions(-)

diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c

index da66a8927..0de070eac 100644

--- a/grub-core/commands/legacycfg.c

+++ b/grub-core/commands/legacycfg.c

@@ -32,6 +32,7 @@

 #include <grub/auth.h>

 #include <grub/disk.h>

 #include <grub/partition.h>

+#include <grub/safemath.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -104,13 +105,22 @@ legacy_file (const char *filename)

 	if (newsuffix)

 	  {

 	    char *t;

-	    

+	    grub_size_t sz;

+

+	    if (grub_add (grub_strlen (suffix), grub_strlen (newsuffix), &sz) ||

+		grub_add (sz, 1, &sz))

+	      {

+		grub_errno = GRUB_ERR_OUT_OF_RANGE;

+		goto fail_0;

+	      }

+

 	    t = suffix;

-	    suffix = grub_realloc (suffix, grub_strlen (suffix)

-				   + grub_strlen (newsuffix) + 1);

+	    suffix = grub_realloc (suffix, sz);

 	    if (!suffix)

 	      {

 		grub_free (t);

+

+ fail_0:

 		grub_free (entrysrc);

 		grub_free (parsed);

 		grub_free (newsuffix);

@@ -154,13 +164,22 @@ legacy_file (const char *filename)

 	  else

 	    {

 	      char *t;

+	      grub_size_t sz;

+

+	      if (grub_add (grub_strlen (entrysrc), grub_strlen (parsed), &sz) ||

+		  grub_add (sz, 1, &sz))

+		{

+		  grub_errno = GRUB_ERR_OUT_OF_RANGE;

+		  goto fail_1;

+		}

 	      t = entrysrc;

-	      entrysrc = grub_realloc (entrysrc, grub_strlen (entrysrc)

-				       + grub_strlen (parsed) + 1);

+	      entrysrc = grub_realloc (entrysrc, sz);

 	      if (!entrysrc)

 		{

 		  grub_free (t);

+

+ fail_1:

 		  grub_free (parsed);

 		  grub_free (suffix);

 		  return grub_errno;

diff --git a/grub-core/commands/wildcard.c b/grub-core/commands/wildcard.c

index 02c46f9fd..c22341137 100644

--- a/grub-core/commands/wildcard.c

+++ b/grub-core/commands/wildcard.c

@@ -23,6 +23,7 @@

 #include <grub/file.h>

 #include <grub/device.h>

 #include <grub/script_sh.h>

+#include <grub/safemath.h>

 #include <regex.h>

@@ -48,6 +49,7 @@ merge (char **dest, char **ps)

   int i;

   int j;

   char **p;

+  grub_size_t sz;

   if (! dest)

     return ps;

@@ -60,7 +62,12 @@ merge (char **dest, char **ps)

   for (j = 0; ps[j]; j++)

     ;

-  p = grub_realloc (dest, sizeof (char*) * (i + j + 1));

+  if (grub_add (i, j, &sz) ||

+      grub_add (sz, 1, &sz) ||

+      grub_mul (sz, sizeof (char *), &sz))

+    return dest;

+

+  p = grub_realloc (dest, sz);

   if (! p)

     {

       grub_free (dest);

@@ -115,8 +122,15 @@ make_regex (const char *start, const char *end, regex_t *regexp)

   char ch;

   int i = 0;

   unsigned len = end - start;

-  char *buffer = grub_malloc (len * 2 + 2 + 1); /* worst case size. */

+  char *buffer;

+  grub_size_t sz;

+  /* Worst case size is (len * 2 + 2 + 1). */

+  if (grub_mul (len, 2, &sz) ||

+      grub_add (sz, 3, &sz))

+    return 1;

+

+  buffer = grub_malloc (sz);

   if (! buffer)

     return 1;

@@ -226,6 +240,7 @@ match_devices_iter (const char *name, void *data)

   struct match_devices_ctx *ctx = data;

   char **t;

   char *buffer;

+  grub_size_t sz;

   /* skip partitions if asked to. */

   if (ctx->noparts && grub_strchr (name, ','))

@@ -239,11 +254,16 @@ match_devices_iter (const char *name, void *data)

   if (regexec (ctx->regexp, buffer, 0, 0, 0))

     {

       grub_dprintf ("expand", "not matched\n");

+ fail:

       grub_free (buffer);

       return 0;

     }

-  t = grub_realloc (ctx->devs, sizeof (char*) * (ctx->ndev + 2));

+  if (grub_add (ctx->ndev, 2, &sz) ||

+      grub_mul (sz, sizeof (char *), &sz))

+    goto fail;

+

+  t = grub_realloc (ctx->devs, sz);

   if (! t)

     {

       grub_free (buffer);

@@ -300,6 +320,7 @@ match_files_iter (const char *name,

   struct match_files_ctx *ctx = data;

   char **t;

   char *buffer;

+  grub_size_t sz;

   /* skip . and .. names */

   if (grub_strcmp(".", name) == 0 || grub_strcmp("..", name) == 0)

@@ -315,9 +336,14 @@ match_files_iter (const char *name,

   if (! buffer)

     return 1;

-  t = grub_realloc (ctx->files, sizeof (char*) * (ctx->nfile + 2));

-  if (! t)

+  if (grub_add (ctx->nfile, 2, &sz) ||

+      grub_mul (sz, sizeof (char *), &sz))

+    goto fail;

+

+  t = grub_realloc (ctx->files, sz);

+  if (!t)

     {

+ fail:

       grub_free (buffer);

       return 1;

     }

diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c

index e6323701a..58f8a53e1 100644

--- a/grub-core/disk/ldm.c

+++ b/grub-core/disk/ldm.c

@@ -25,6 +25,7 @@

 #include <grub/msdos_partition.h>

 #include <grub/gpt_partition.h>

 #include <grub/i18n.h>

+#include <grub/safemath.h>

 #ifdef GRUB_UTIL

 #include <grub/emu/misc.h>

@@ -289,6 +290,7 @@ make_vg (grub_disk_t disk,

       struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE

 				/ sizeof (struct grub_ldm_vblk)];

       unsigned i;

+      grub_size_t sz;

       err = grub_disk_read (disk, cursec, 0,

 			    sizeof(vblk), &vblk);

       if (err)

@@ -350,7 +352,13 @@ make_vg (grub_disk_t disk,

 	      grub_free (lv);

 	      goto fail2;

 	    }

-	  lv->name = grub_malloc (*ptr + 1);

+	  if (grub_add (*ptr, 1, &sz))

+	    {

+	      grub_free (lv->internal_id);

+	      grub_free (lv);

+	      goto fail2;

+	    }

+	  lv->name = grub_malloc (sz);

 	  if (!lv->name)

 	    {

 	      grub_free (lv->internal_id);

@@ -599,10 +607,13 @@ make_vg (grub_disk_t disk,

 	  if (lv->segments->node_alloc == lv->segments->node_count)

 	    {

 	      void *t;

-	      lv->segments->node_alloc *= 2; 

-	      t = grub_realloc (lv->segments->nodes,

-				sizeof (*lv->segments->nodes)

-				* lv->segments->node_alloc);

+	      grub_size_t sz;

+

+	      if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) ||

+		  grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz))

+		goto fail2;

+

+	      t = grub_realloc (lv->segments->nodes, sz);

 	      if (!t)

 		goto fail2;

 	      lv->segments->nodes = t;

@@ -723,10 +734,13 @@ make_vg (grub_disk_t disk,

 	      if (comp->segment_alloc == comp->segment_count)

 		{

 		  void *t;

-		  comp->segment_alloc *= 2;

-		  t = grub_realloc (comp->segments,

-				    comp->segment_alloc

-				    * sizeof (*comp->segments));

+		  grub_size_t sz;

+

+		  if (grub_mul (comp->segment_alloc, 2, &comp->segment_alloc) ||

+		      grub_mul (comp->segment_alloc, sizeof (*comp->segments), &sz))

+		    goto fail2;

+

+		  t = grub_realloc (comp->segments, sz);

 		  if (!t)

 		    goto fail2;

 		  comp->segments = t;

diff --git a/grub-core/font/font.c b/grub-core/font/font.c

index 68967dc1c..d63354fb5 100644

--- a/grub-core/font/font.c

+++ b/grub-core/font/font.c

@@ -30,6 +30,7 @@

 #include <grub/unicode.h>

 #include <grub/fontformat.h>

 #include <grub/env.h>

+#include <grub/safemath.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -360,9 +361,13 @@ static char *

 read_section_as_string (struct font_file_section *section)

 {

   char *str;

+  grub_size_t sz;

   grub_ssize_t ret;

-  str = grub_malloc (section->length + 1);

+  if (grub_add (section->length, 1, &sz))

+    return NULL;

+

+  str = grub_malloc (sz);

   if (!str)

     return 0;

diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c

index 8c8aa9c31..1d801f6c9 100644

--- a/grub-core/fs/btrfs.c

+++ b/grub-core/fs/btrfs.c

@@ -33,6 +33,7 @@

 #include <grub/env.h>

 #include <grub/extcmd.h>

 #include <grub/list.h>

+#include <grub/safemath.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -321,9 +322,13 @@ save_ref (struct grub_btrfs_leaf_descriptor *desc,

   if (desc->allocated < desc->depth)

     {

       void *newdata;

-      desc->allocated *= 2;

-      newdata = grub_realloc (desc->data, sizeof (desc->data[0])

-			      * desc->allocated);

+      grub_size_t sz;

+

+      if (grub_mul (desc->allocated, 2, &desc->allocated) ||

+	  grub_mul (desc->allocated, sizeof (desc->data[0]), &sz))

+	return GRUB_ERR_OUT_OF_RANGE;

+

+      newdata = grub_realloc (desc->data, sz);

       if (!newdata)

 	return grub_errno;

       desc->data = newdata;

@@ -618,15 +623,21 @@ find_device (struct grub_btrfs_data *data, grub_uint64_t id, int do_rescan)

   if (data->n_devices_attached > data->n_devices_allocated)

     {

       void *tmp;

-      data->n_devices_allocated = 2 * data->n_devices_attached + 1;

-      data->devices_attached

-	= grub_realloc (tmp = data->devices_attached,

-			data->n_devices_allocated

-			* sizeof (data->devices_attached[0]));

+      grub_size_t sz;

+

+      if (grub_mul (data->n_devices_attached, 2, &data->n_devices_allocated) ||

+	  grub_add (data->n_devices_allocated, 1, &data->n_devices_allocated) ||

+	  grub_mul (data->n_devices_allocated, sizeof (data->devices_attached[0]), &sz))

+	goto fail;

+

+      data->devices_attached = grub_realloc (tmp = data->devices_attached, sz);

       if (!data->devices_attached)

 	{

-	  grub_device_close (ctx.dev_found);

 	  data->devices_attached = tmp;

+

+ fail:

+	  if (ctx.dev_found)

+	    grub_device_close (ctx.dev_found);

 	  return NULL;

 	}

     }

diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c

index b8ad75a0f..b4bd019f4 100644

--- a/grub-core/fs/ext2.c

+++ b/grub-core/fs/ext2.c

@@ -46,6 +46,7 @@

 #include <grub/dl.h>

 #include <grub/types.h>

 #include <grub/fshelp.h>

+#include <grub/safemath.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -703,6 +704,7 @@ grub_ext2_read_symlink (grub_fshelp_node_t node)

 {

   char *symlink;

   struct grub_fshelp_node *diro = node;

+  grub_size_t sz;

   if (! diro->inode_read)

     {

@@ -717,7 +719,13 @@ grub_ext2_read_symlink (grub_fshelp_node_t node)

        }

     }

-  symlink = grub_malloc (grub_le_to_cpu32 (diro->inode.size) + 1);

+  if (grub_add (grub_le_to_cpu32 (diro->inode.size), 1, &sz))

+    {

+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));

+      return NULL;

+    }

+

+  symlink = grub_malloc (sz);

   if (! symlink)

     return 0;

diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c

index 092b8f409..f45841e2b 100644

--- a/grub-core/fs/iso9660.c

+++ b/grub-core/fs/iso9660.c

@@ -28,6 +28,7 @@

 #include <grub/fshelp.h>

 #include <grub/charset.h>

 #include <grub/datetime.h>

+#include <grub/safemath.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -531,8 +532,13 @@ add_part (struct iterate_dir_ctx *ctx,

 	  int len2)

 {

   int size = ctx->symlink ? grub_strlen (ctx->symlink) : 0;

+  grub_size_t sz;

-  ctx->symlink = grub_realloc (ctx->symlink, size + len2 + 1);

+  if (grub_add (size, len2, &sz) ||

+      grub_add (sz, 1, &sz))

+    return;

+

+  ctx->symlink = grub_realloc (ctx->symlink, sz);

   if (! ctx->symlink)

     return;

@@ -560,17 +566,24 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,

 	{

 	  grub_size_t off = 0, csize = 1;

 	  char *old;

+	  grub_size_t sz;

+

 	  csize = entry->len - 5;

 	  old = ctx->filename;

 	  if (ctx->filename_alloc)

 	    {

 	      off = grub_strlen (ctx->filename);

-	      ctx->filename = grub_realloc (ctx->filename, csize + off + 1);

+	      if (grub_add (csize, off, &sz) ||

+		  grub_add (sz, 1, &sz))

+		return GRUB_ERR_OUT_OF_RANGE;

+	      ctx->filename = grub_realloc (ctx->filename, sz);

 	    }

 	  else

 	    {

 	      off = 0;

-	      ctx->filename = grub_zalloc (csize + 1);

+	      if (grub_add (csize, 1, &sz))

+		return GRUB_ERR_OUT_OF_RANGE;

+	      ctx->filename = grub_zalloc (sz);

 	    }

 	  if (!ctx->filename)

 	    {

@@ -776,14 +789,18 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,

 	    if (node->have_dirents >= node->alloc_dirents)

 	      {

 		struct grub_fshelp_node *new_node;

-		node->alloc_dirents *= 2;

-		new_node = grub_realloc (node, 

-					 sizeof (struct grub_fshelp_node)

-					 + ((node->alloc_dirents

-					     - ARRAY_SIZE (node->dirents))

-					    * sizeof (node->dirents[0])));

+		grub_size_t sz;

+

+		if (grub_mul (node->alloc_dirents, 2, &node->alloc_dirents) ||

+		    grub_sub (node->alloc_dirents, ARRAY_SIZE (node->dirents), &sz) ||

+		    grub_mul (sz, sizeof (node->dirents[0]), &sz) ||

+		    grub_add (sz, sizeof (struct grub_fshelp_node), &sz))

+		  goto fail_0;

+

+		new_node = grub_realloc (node, sz);

 		if (!new_node)

 		  {

+ fail_0:

 		    if (ctx.filename_alloc)

 		      grub_free (ctx.filename);

 		    grub_free (node);

@@ -799,14 +816,18 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,

 		* sizeof (node->dirents[0]) < grub_strlen (ctx.symlink) + 1)

 	      {

 		struct grub_fshelp_node *new_node;

-		new_node = grub_realloc (node,

-					 sizeof (struct grub_fshelp_node)

-					 + ((node->alloc_dirents

-					     - ARRAY_SIZE (node->dirents))

-					    * sizeof (node->dirents[0]))

-					 + grub_strlen (ctx.symlink) + 1);

+		grub_size_t sz;

+

+		if (grub_sub (node->alloc_dirents, ARRAY_SIZE (node->dirents), &sz) ||

+		    grub_mul (sz, sizeof (node->dirents[0]), &sz) ||

+		    grub_add (sz, sizeof (struct grub_fshelp_node) + 1, &sz) ||

+		    grub_add (sz, grub_strlen (ctx.symlink), &sz))

+		  goto fail_1;

+

+		new_node = grub_realloc (node, sz);

 		if (!new_node)

 		  {

+ fail_1:

 		    if (ctx.filename_alloc)

 		      grub_free (ctx.filename);

 		    grub_free (node);

diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c

index 663931717..3ddc6b5e2 100644

--- a/grub-core/fs/sfs.c

+++ b/grub-core/fs/sfs.c

@@ -26,6 +26,7 @@

 #include <grub/types.h>

 #include <grub/fshelp.h>

 #include <grub/charset.h>

+#include <grub/safemath.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -307,10 +308,15 @@ grub_sfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)

       if (node->cache && node->cache_size >= node->cache_allocated)

 	{

 	  struct cache_entry *e = node->cache;

-	  e = grub_realloc (node->cache,node->cache_allocated * 2

-			    * sizeof (e[0]));

+	  grub_size_t sz;

+

+	  if (grub_mul (node->cache_allocated, 2 * sizeof (e[0]), &sz))

+	    goto fail;

+

+	  e = grub_realloc (node->cache, sz);

 	  if (!e)

 	    {

+ fail:

 	      grub_errno = 0;

 	      grub_free (node->cache);

 	      node->cache = 0;

@@ -477,10 +483,16 @@ grub_sfs_create_node (struct grub_fshelp_node **node,

   grub_size_t len = grub_strlen (name);

   grub_uint8_t *name_u8;

   int ret;

+  grub_size_t sz;

+

+  if (grub_mul (len, GRUB_MAX_UTF8_PER_LATIN1, &sz) ||

+      grub_add (sz, 1, &sz))

+    return 1;

+

   *node = grub_malloc (sizeof (**node));

   if (!*node)

     return 1;

-  name_u8 = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);

+  name_u8 = grub_malloc (sz);

   if (!name_u8)

     {

       grub_free (*node);

@@ -724,8 +736,13 @@ grub_sfs_label (grub_device_t device, char **label)

   data = grub_sfs_mount (disk);

   if (data)

     {

-      grub_size_t len = grub_strlen (data->label);

-      *label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);

+      grub_size_t sz, len = grub_strlen (data->label);

+

+      if (grub_mul (len, GRUB_MAX_UTF8_PER_LATIN1, &sz) ||

+	  grub_add (sz, 1, &sz))

+	return GRUB_ERR_OUT_OF_RANGE;

+

+      *label = grub_malloc (sz);

       if (*label)

 	*grub_latin1_to_utf8 ((grub_uint8_t *) *label,

 			      (const grub_uint8_t *) data->label,

diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c

index 2c967c65a..f9bef38fc 100644

--- a/grub-core/fs/squash4.c

+++ b/grub-core/fs/squash4.c

@@ -26,6 +26,7 @@

 #include <grub/types.h>

 #include <grub/fshelp.h>

 #include <grub/deflate.h>

+#include <grub/safemath.h>

 #include <minilzo.h>

 #include "xz.h"

@@ -459,7 +460,17 @@ grub_squash_read_symlink (grub_fshelp_node_t node)

 {

   char *ret;

   grub_err_t err;

-  ret = grub_malloc (grub_le_to_cpu32 (node->ino.symlink.namelen) + 1);

+  grub_size_t sz;

+

+  if (grub_add (grub_le_to_cpu32 (node->ino.symlink.namelen), 1, &sz))

+    {

+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));

+      return NULL;

+    }

+

+  ret = grub_malloc (sz);

+  if (!ret)

+    return NULL;

   err = read_chunk (node->data, ret,

 		    grub_le_to_cpu32 (node->ino.symlink.namelen),

@@ -506,11 +517,16 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,

   {

     grub_fshelp_node_t node;

-    node = grub_malloc (sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));

+    grub_size_t sz;

+

+    if (grub_mul (dir->stsize, sizeof (dir->stack[0]), &sz) ||

+	grub_add (sz, sizeof (*node), &sz))

+      return 0;

+

+    node = grub_malloc (sz);

     if (!node)

       return 0;

-    grub_memcpy (node, dir,

-		 sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));

+    grub_memcpy (node, dir, sz);

     if (hook (".", GRUB_FSHELP_DIR, node, hook_data))

       return 1;

@@ -518,12 +534,15 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,

       {

 	grub_err_t err;

-	node = grub_malloc (sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));

+	if (grub_mul (dir->stsize, sizeof (dir->stack[0]), &sz) ||

+	    grub_add (sz, sizeof (*node), &sz))

+	  return 0;

+

+	node = grub_malloc (sz);

 	if (!node)

 	  return 0;

-	grub_memcpy (node, dir,

-		     sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));

+	grub_memcpy (node, dir, sz);

 	node->stsize--;

 	err = read_chunk (dir->data, &node->ino, sizeof (node->ino),

@@ -557,6 +576,7 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,

 	  enum grub_fshelp_filetype filetype = GRUB_FSHELP_REG;

 	  struct grub_squash_dirent di;

 	  struct grub_squash_inode ino;

+	  grub_size_t sz;

 	  err = read_chunk (dir->data, &di, sizeof (di),

 			    grub_le_to_cpu64 (dir->data->sb.diroffset)

@@ -589,13 +609,16 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,

 	  if (grub_le_to_cpu16 (di.type) == SQUASH_TYPE_SYMLINK)

 	    filetype = GRUB_FSHELP_SYMLINK;

-	  node = grub_malloc (sizeof (*node)

-			      + (dir->stsize + 1) * sizeof (dir->stack[0]));

+	  if (grub_add (dir->stsize, 1, &sz) ||

+	      grub_mul (sz, sizeof (dir->stack[0]), &sz) ||

+	      grub_add (sz, sizeof (*node), &sz))

+	    return 0;

+

+	  node = grub_malloc (sz);

 	  if (! node)

 	    return 0;

-	  grub_memcpy (node, dir,

-		       sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));

+	  grub_memcpy (node, dir, sz - sizeof(dir->stack[0]));

 	  node->ino = ino;

 	  node->stack[node->stsize].ino_chunk = grub_le_to_cpu32 (dh.ino_chunk);

diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c

index 44481da7c..be41b48f9 100644

--- a/grub-core/fs/udf.c

+++ b/grub-core/fs/udf.c

@@ -28,6 +28,7 @@

 #include <grub/charset.h>

 #include <grub/datetime.h>

 #include <grub/udf.h>

+#include <grub/safemath.h>

 GRUB_MOD_LICENSE ("GPLv3+");

@@ -890,9 +891,19 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)

 	utf16[i] = (raw[2 * i + 1] << 8) | raw[2*i + 2];

     }

   if (!outbuf)

-    outbuf = grub_malloc (utf16len * GRUB_MAX_UTF8_PER_UTF16 + 1);

+    {

+      grub_size_t size;

+

+      if (grub_mul (utf16len, GRUB_MAX_UTF8_PER_UTF16, &size) ||

+	  grub_add (size, 1, &size))

+	goto fail;

+

+      outbuf = grub_malloc (size);

+    }

   if (outbuf)

     *grub_utf16_to_utf8 ((grub_uint8_t *) outbuf, utf16, utf16len) = '\0';

+

+ fail:

   grub_free (utf16);

   return outbuf;

 }

@@ -1005,7 +1016,7 @@ grub_udf_read_symlink (grub_fshelp_node_t node)

   grub_size_t sz = U64 (node->block.fe.file_size);

   grub_uint8_t *raw;

   const grub_uint8_t *ptr;

-  char *out, *optr;

+  char *out = NULL, *optr;