Fix CWE-789: Uncontrolled Memory Allocation by changing malloc to calloc

Dependencies/protobuf-c/protobuf-c/protobuf-c.c

@@ -45,7 +45,7 @@
  * \todo Use size_t consistently.
  */
 
-#include <stdlib.h>	/* for malloc, free */
+#include <stdlib.h>	/* for calloc, free */
 #include <string.h>	/* for strcmp, strlen, memcpy, memmove, memset */
 
 #include "protobuf-c.h"
@@ -151,7 +151,7 @@ static void *
 system_alloc(void *allocator_data, size_t size)
 {
 	(void)allocator_data;
-	return malloc(size);
+	return calloc(1, size);
 }
 
 static void
@@ -175,7 +175,7 @@ do_free(ProtobufCAllocator *allocator, void *data)
 }
 
 /*
- * This allocator uses the system's malloc() and free(). It is the default
+ * This allocator uses the system's calloc() and free(). It is the default
  * allocator used if NULL is passed as the ProtobufCAllocator to an exported
  * function.
  */

Dependencies/protobuf-c/protobuf-c/protobuf-c.h

@@ -127,7 +127,7 @@ void foo__bar__baz_bah__init
 ~~~
  * - `unpack()`. Unpacks data for a particular message format. Note that the
  *   `allocator` parameter is usually `NULL` to indicate that the system's
- *   `malloc()` and `free()` functions should be used for dynamically allocating
+ *   `calloc()` and `free()` functions should be used for dynamically allocating
  *   memory.
  *
 ~~~{.c}

Source/PLCrashAsyncLinkedList.hpp

@@ -66,7 +66,7 @@ class async_list {
 
         // Custom new/delete that do not rely on the stdlib
         void *operator new (size_t size) {
-            void *ptr = malloc(size);
+            void *ptr = calloc(1, size);
             PLCF_ASSERT(ptr != NULL);
             return ptr;
         }
@@ -127,7 +127,7 @@ class async_list {
 
     // Custom new/delete that do not rely on the stdlib
     void *operator new (size_t size) {
-        void *ptr = malloc(size);
+        void *ptr = calloc(1, size);
         PLCF_ASSERT(ptr != NULL);
         return ptr;
     }

Source/PLCrashHostInfo.m

@@ -103,7 +103,7 @@ - (instancetype) init {
     /* Extract the Darwin version */
     char *val = plcrash_sysctl_string("kern.osrelease");
     if (val == NULL) {
-        /* This should never fail; if it does, either malloc failed, or 'kern.osrelease' disappeared. */
+        /* This should never fail; if it does, either calloc failed, or 'kern.osrelease' disappeared. */
         PLCR_LOG("Failed to fetch kern.osrelease value %d: %s", errno, strerror(errno));
         return nil;
     }

Source/PLCrashLogWriter.m

@@ -258,7 +258,7 @@
 };
 
 static void plprotobuf_cbinary_data_init (PLProtobufCBinaryData *data, const void *pointer, size_t len) {
-    data->data = malloc(len);
+    data->data = calloc(1, len);
     memcpy(data->data , pointer, len);
     data->len = len;
 }
@@ -356,7 +356,7 @@ plcrash_error_t plcrash_log_writer_init (plcrash_log_writer_t *writer,
             uint32_t process_path_len = 0;
             _NSGetExecutablePath(NULL, &process_path_len);
             if (process_path_len > 0) {
-                char *process_path = malloc(process_path_len);
+                char *process_path = calloc(1, process_path_len);
                 _NSGetExecutablePath(process_path, &process_path_len);
                 writer->process_info.process_path.data = process_path;
                 writer->process_info.process_path.len = process_path_len;
@@ -496,7 +496,7 @@ void plcrash_log_writer_set_exception (plcrash_log_writer_t *writer, NSException
     if (callStackArray != nil && [callStackArray count] > 0) {
         size_t count = [callStackArray count];
         writer->uncaught_exception.callstack_count = count;
-        writer->uncaught_exception.callstack = malloc(sizeof(void *) * count);
+        writer->uncaught_exception.callstack = calloc(1, sizeof(void *) * count);
 
         size_t i = 0;
         for (NSNumber *num in callStackArray) {

Source/PLCrashReport.m

@@ -129,7 +129,7 @@ - (id) initWithData: (NSData *) encodedData error: (NSError **) outError {
 
 
     /* Allocate the struct and attempt to parse */
-    _decoder = malloc(sizeof(_PLCrashReportDecoder));
+    _decoder = calloc(1, sizeof(_PLCrashReportDecoder));
     _decoder->crashReport = [self decodeCrashData: encodedData error: outError];
 
     /* Check if decoding failed. If so, outError has already been populated. */

Source/PLCrashReportBinaryImageInfo.m

@@ -93,7 +93,7 @@ - (id) initWithCodeType: (PLCrashReportProcessorInfo *) processorInfo
         /* Convert UUID to ASCII hex representation. */
         size_t inlen = [uuid length];
         size_t outlen = inlen * 2;
-        char *output = malloc(outlen);
+        char *output = calloc(1, outlen);
         const char hex[] = "0123456789abcdef";
         const uint8_t *bytes = [uuid bytes];
 

Source/PLCrashSignalHandler.mm

@@ -294,10 +294,10 @@ - (id) init {
     /* Set up an alternate signal stack for crash dumps. Only 64k is reserved, and the
      * crash dump path must be sparing in its use of stack space. */
     _sigstk.ss_size = MAX(MINSIGSTKSZ, 64 * 1024);
-    _sigstk.ss_sp = malloc(_sigstk.ss_size);
+    _sigstk.ss_sp = calloc(1, _sigstk.ss_size);
     _sigstk.ss_flags = 0;
 
-    /* (Unlikely) malloc failure */
+    /* (Unlikely) calloc failure */
     if (_sigstk.ss_sp == NULL) {
         return nil;
     }

Source/PLCrashSysctl.c

@@ -47,11 +47,11 @@
  * @param name The sysctl MIB name.
  * @param length On success, will be populated with the length of the result. If NULL, length will not be supplied.
  *
- * @return Returns a malloc-allocated buffer containing the sysctl result on success. On failure, NULL is returned
+ * @return Returns a calloc-allocated buffer containing the sysctl result on success. On failure, NULL is returned
  * and the global variable errno is set to indicate the error. The caller is responsible for free()'ing the returned
  * buffer.
  */
-static void *plcrash_sysctl_malloc (const char *name, size_t *length) {
+static void *plcrash_sysctl_calloc (const char *name, size_t *length) {
     /* Attempt to fetch the data, looping until our buffer is sufficiently sized. */
     void *result = NULL;
     size_t result_len = 0;
@@ -67,7 +67,7 @@ static void *plcrash_sysctl_malloc (const char *name, size_t *length) {
         /* Allocate the destination buffer */
         if (result != NULL)
             free(result);
-        result = malloc(result_len);
+        result = calloc(1, result_len);
 
         /* Fetch the value */
         ret = sysctlbyname(name, result, &result_len, NULL, 0);
@@ -97,12 +97,12 @@ static void *plcrash_sysctl_malloc (const char *name, size_t *length) {
  * @param name The sysctl MIB name.
  * @param length On success, will be populated with the length of the result. If NULL, length will not be supplied.
  *
- * @return Returns a malloc-allocated NULL-terminated C string containing the sysctl result on success. On failure,
+ * @return Returns a calloc-allocated NULL-terminated C string containing the sysctl result on success. On failure,
  * NULL is returned and the global variable errno is set to indicate the error. The caller is responsible for
  * free()'ing the returned buffer.
  */
 char *plcrash_sysctl_string (const char *name) {
-    return plcrash_sysctl_malloc(name, NULL);
+    return plcrash_sysctl_calloc(name, NULL);
 }
 
 /**

Tests/PLCrashLogWriterTests.m

@@ -162,7 +162,7 @@ - (void) checkProcessInfo: (Plcrash__CrashReport *) crashReport {
 
     _NSGetExecutablePath(NULL, &process_path_len);
     if (process_path_len > 0) {
-        process_path = malloc(process_path_len);
+        process_path = calloc(1, process_path_len);
         _NSGetExecutablePath(process_path, &process_path_len);
         STAssertEqualCStrings(procInfo->process_path, process_path, @"Incorrect process name");
         free(process_path);