libparted: gpt: avoid heap-read-overrun when rewriting 9-PTE table

Now that parted can rewrite a corrupt-or-misaligned 9-PTE table,
we have to be careful to allocate space for slightly more data
when the byte-count required for a PTE table is smaller than
the whole number of sectors would imply.  I.e., when the PTE table
size is not a multiple of the sector size, there is a fraction of
that final sector for which we do not read data, but we do write.
Ensure we have space for the buffer we'll write and that it is
initialized (to 0's).
* libparted/labels/gpt.c (gpt_write): Allocate the right amount of
space.  Use calloc, not malloc+memset.

diff --git a/libparted/labels/gpt.c b/libparted/labels/gpt.c
index 4a5d357..84bdc12 100644 (file)
--- a/libparted/labels/gpt.c
+++ b/libparted/labels/gpt.c
@@ -1219,10 +1219,13 @@ gpt_write (const PedDisk *disk)
 
   size_t ptes_bytes = (gpt_disk_data->entry_count
                        * sizeof (GuidPartitionEntry_t));
-  GuidPartitionEntry_t *ptes = malloc (ptes_bytes);
+  size_t ss = disk->dev->sector_size;
+  PedSector ptes_sectors = (ptes_bytes + ss - 1) / ss;
+  /* Note that we allocate a little more than ptes_bytes,
+     when that number is not a multiple of sector size.  */
+  GuidPartitionEntry_t *ptes = calloc (ptes_sectors, ss);
   if (!ptes)
     goto error;
-  memset (ptes, 0, ptes_bytes);
   for (part = ped_disk_next_partition (disk, NULL); part;
        part = ped_disk_next_partition (disk, part))
     {
@@ -1249,8 +1252,6 @@ gpt_write (const PedDisk *disk)
   free (pth_raw);
   if (!write_ok)
     goto error_free_ptes;
-  size_t ss = disk->dev->sector_size;
-  PedSector ptes_sectors = (ptes_bytes + ss - 1) / ss;
   if (!ped_device_write (disk->dev, ptes, 2, ptes_sectors))
     goto error_free_ptes;