Initialized initrd_ctx so we don't free a random pointer from the stack.

Currently, if "linux" fails, the "goto fail;" in grub_cmd_initrd sends us
into grub_initrd_close() without grub_initrd_init() being called, and thus
it never clears initrd_ctx->components.  grub_initrd_close() then frees that
address, which is stale data from the stack.  If the stack happens to have a
stale *address* there that matches a recent allocation, then you'll get a
double free later.

So initialize the memory up front.

Signed-off-by: Peter Jones <pjones@redhat.com>

diff --git a/ChangeLog b/ChangeLog
index 2bbf501f5b75cd24023e83c4879383f9c0e01453..1c79b7789b4c9fe25d03f6196a5c57e42e39e44e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2014-21-15  Peter Jones  <pjones@redhat.com>
+
+       * grub-core/loader/arm/linux.c: Initialized initrd_ctx so
+       we don't free a random pointer from the stack.
+       * grub-core/loader/arm64/linux.c: Likewise.
+       * grub-core/loader/i386/linux.c: Likewise.
+       * grub-core/loader/i386/pc/linux.c: Likewise.
+       * grub-core/loader/ia64/efi/linux.c: Likewise.
+       * grub-core/loader/mips/linux.c: Likewise.
+       * grub-core/loader/powerpc/ieee1275/linux.c: Likewise.
+       * grub-core/loader/sparc64/ieee1275/linux.c: Likewise.
+
 2014-09-15  Khem Raj  <raj.khem@gmail.com>
 
        * grub-core/kern/emu/hostfs.c: use _DEFAULT_SOURCE in addition to

diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c
index e6770d96d292189356be046fb36399f313ec74f4..62cbe75d34ecd35b8eb56240ef1b19fb5ab5bd87 100644 (file)
--- a/grub-core/loader/arm/linux.c
+++ b/grub-core/loader/arm/linux.c
@@ -396,7 +396,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
 {
   grub_file_t file;
   grub_size_t size = 0;
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
 
   if (argc == 0)
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
index f1d10a164923e221258e57e4866ffcf81fb8c4cd..0dc144e5da0efce6d5fac3ddcb0ad5edfdce00da 100644 (file)
--- a/grub-core/loader/arm64/linux.c
+++ b/grub-core/loader/arm64/linux.c
@@ -328,7 +328,7 @@ static grub_err_t
 grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
                 int argc, char *argv[])
 {
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
   int initrd_size, initrd_pages;
   void *initrd_mem = NULL;
 

diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
index 31fb91e2c7307b9ef63ded7c01e70aedcd8ea53e..2ae176315b620d64de690bb9de742841e5543231 100644 (file)
--- a/grub-core/loader/i386/linux.c
+++ b/grub-core/loader/i386/linux.c
@@ -1050,7 +1050,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
   grub_addr_t addr_min, addr_max;
   grub_addr_t addr;
   grub_err_t err;
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
 
   if (argc == 0)
     {

diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
index 672c013e74d26520f7f8abc84a413019e5d0b4aa..b481e4668465411210b822f256172ad2b2a75073 100644 (file)
--- a/grub-core/loader/i386/pc/linux.c
+++ b/grub-core/loader/i386/pc/linux.c
@@ -388,7 +388,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
   grub_uint8_t *initrd_chunk;
   grub_addr_t initrd_addr;
   grub_err_t err;
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
 
   if (argc == 0)
     {

diff --git a/grub-core/loader/ia64/efi/linux.c b/grub-core/loader/ia64/efi/linux.c
index 87ac49f8c3b5137ea24234fe99382ed883478bd2..eb78e6e626b9622a03a55a4614660e3f17000562 100644 (file)
--- a/grub-core/loader/ia64/efi/linux.c
+++ b/grub-core/loader/ia64/efi/linux.c
@@ -568,7 +568,7 @@ static grub_err_t
 grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
                 int argc, char *argv[])
 {
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
 
   if (argc == 0)
     {

diff --git a/grub-core/loader/mips/linux.c b/grub-core/loader/mips/linux.c
index ef64a5b1d362c53d1b6300f23bbe928aa8b487c2..4a3e8c5dfa2bcc9a72da4f49c0f7cf3634734c2f 100644 (file)
--- a/grub-core/loader/mips/linux.c
+++ b/grub-core/loader/mips/linux.c
@@ -415,7 +415,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
   void *initrd_src;
   grub_addr_t initrd_dest;
   grub_err_t err;
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
 
   if (argc == 0)
     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));

diff --git a/grub-core/loader/powerpc/ieee1275/linux.c b/grub-core/loader/powerpc/ieee1275/linux.c
index 4a14f66dee52ed081b0801899727ac627eea30fd..787d7dc2af3b8266f81ab5ece9a80968f43b4635 100644 (file)
--- a/grub-core/loader/powerpc/ieee1275/linux.c
+++ b/grub-core/loader/powerpc/ieee1275/linux.c
@@ -333,7 +333,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
   grub_size_t size = 0;
   grub_addr_t first_addr;
   grub_addr_t addr;
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
 
   if (argc == 0)
     {

diff --git a/grub-core/loader/sparc64/ieee1275/linux.c b/grub-core/loader/sparc64/ieee1275/linux.c
index de6ee2f75ed179c4a16ddcad849b25ac77c785be..c5e8dfab23481b0e2a7e6cdba2bf83cbe6c14219 100644 (file)
--- a/grub-core/loader/sparc64/ieee1275/linux.c
+++ b/grub-core/loader/sparc64/ieee1275/linux.c
@@ -373,7 +373,7 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
   grub_addr_t paddr;
   grub_addr_t addr;
   int ret;
-  struct grub_linux_initrd_context initrd_ctx;
+  struct grub_linux_initrd_context initrd_ctx = { 0, };
 
   if (argc == 0)
     {