grub_zstdio_open() sizes its allocation with sizeof (zstdio_t), which is the pointer typedef rather than struct zstdio. The buffers in bufs[] therefore start sizeof (struct zstdio) - sizeof (zstdio_t) bytes (80 on x86_64) further into the allocation than it allows for, and every full output chunk writes that many bytes past its end.
On a Xen PV guest booting a zstd-compressed kernel this corrupts the heap and GRUB aborts with "alloc magic is broken" while loading the initrd. (Though, this may depend on what happens to follow the allocation.) Fixes: 8ea83c3ee (io/zstdio: Implement zstdio decompression) Signed-off-by: Logan Gunthorpe <[email protected]> --- grub-core/io/zstdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/io/zstdio.c b/grub-core/io/zstdio.c index 379eba0c6e00..c3807379097a 100644 --- a/grub-core/io/zstdio.c +++ b/grub-core/io/zstdio.c @@ -81,7 +81,7 @@ grub_zstdio_open (grub_file_t io, enum grub_file_type type) if (file == NULL) return NULL; - zstdio = grub_zalloc (sizeof (zstdio_t) + ZSTD_DStreamInSize () + + zstdio = grub_zalloc (sizeof (*zstdio) + ZSTD_DStreamInSize () + ZSTD_DStreamOutSize ()); if (zstdio == NULL) { -- 2.47.3 _______________________________________________ Grub-devel mailing list [email protected] https://lists.gnu.org/mailman/listinfo/grub-devel
