From 484ddd29262fa7c01840428c9da31267a4973aa7 Mon Sep 17 00:00:00 2001
From: Jan Janssen <medhefgo@web.de>
Date: Mon, 15 Nov 2021 12:25:04 +0100
Subject: [PATCH 1/5] sd-boot: Add non-failing allocators

---
 src/boot/efi/util.h | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/src/boot/efi/util.h b/src/boot/efi/util.h
index e925f1728b..9505d3bf21 100644
--- a/src/boot/efi/util.h
+++ b/src/boot/efi/util.h
@@ -24,6 +24,29 @@
 #define UINT64_MAX ((UINT64) -1)
 #endif
 
+#define assert_alloc_ret(p)     \
+        ({                      \
+                void *_p = (p); \
+                assert(_p);     \
+                _p;             \
+        })
+
+#define xnew_alloc(type, n, alloc)                                           \
+        ({                                                                   \
+                UINTN _alloc_size;                                           \
+                if (__builtin_mul_overflow(sizeof(type), (n), &_alloc_size)) \
+                        assert_not_reached();                                \
+                (type *) alloc(_alloc_size);                                 \
+        })
+
+#define xallocate_pool(size) assert_alloc_ret(AllocatePool(size))
+#define xallocate_zero_pool(size) assert_alloc_ret(AllocateZeroPool(size))
+#define xreallocate_pool(p, old_size, new_size) assert_alloc_ret(ReallocatePool((p), (old_size), (new_size)))
+#define xpool_print(fmt, ...) ((CHAR16 *) assert_alloc_ret(PoolPrint((fmt), ##__VA_ARGS__)))
+#define xstrdup(str) ((CHAR16 *) assert_alloc_ret(StrDuplicate(str)))
+#define xnew(type, n) xnew_alloc(type, (n), xallocate_pool)
+#define xnew0(type, n) xnew_alloc(type, (n), xallocate_zero_pool)
+
 EFI_STATUS parse_boolean(const CHAR8 *v, BOOLEAN *b);
 
 UINT64 ticks_read(void);

From da76f890aab165ac194b21ac41289df70d0b6a3f Mon Sep 17 00:00:00 2001
From: Jan Janssen <medhefgo@web.de>
Date: Mon, 15 Nov 2021 12:28:18 +0100
Subject: [PATCH 2/5] sd-boot: Use non-failing allocators in boot.c

---
 src/boot/efi/boot.c | 137 ++++++++++++++++++--------------------------
 1 file changed, 55 insertions(+), 82 deletions(-)

diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
index 0bacfb4bbe..05aecabc8a 100644
--- a/src/boot/efi/boot.c
+++ b/src/boot/efi/boot.c
@@ -144,15 +144,11 @@ static BOOLEAN line_edit(
                 line_in = L"";
 
         size = StrLen(line_in) + 1024;
-        line = AllocatePool(size * sizeof(CHAR16));
-        if (!line)
-                return FALSE;
+        line = xnew(CHAR16, size);
 
         StrCpy(line, line_in);
         len = StrLen(line);
-        print = AllocatePool((x_max+1) * sizeof(CHAR16));
-        if (!print)
-                return FALSE;
+        print = xnew(CHAR16, x_max + 1);
 
         first = 0;
         cursor = 0;
@@ -422,13 +418,13 @@ static CHAR16 *update_timeout_efivar(UINT32 *t, BOOLEAN inc) {
 
         switch (*t) {
         case TIMEOUT_UNSET:
-                return StrDuplicate(L"Menu timeout defined by configuration file.");
+                return xstrdup(L"Menu timeout defined by configuration file.");
         case TIMEOUT_MENU_FORCE:
-                return StrDuplicate(L"Timeout disabled, menu will always be shown.");
+                return xstrdup(L"Timeout disabled, menu will always be shown.");
         case TIMEOUT_MENU_HIDDEN:
-                return StrDuplicate(L"Menu disabled. Hold down key at bootup to show menu.");
+                return xstrdup(L"Menu disabled. Hold down key at bootup to show menu.");
         default:
-                return PoolPrint(L"Menu timeout set to %u s.", *t);
+                return xpool_print(L"Menu timeout set to %u s.", *t);
         }
 }
 
@@ -656,21 +652,12 @@ static BOOLEAN menu_run(
                         clearline = mfree(clearline);
 
                         /* menu entries title lines */
-                        lines = AllocatePool((config->entry_count + 1) * sizeof(CHAR16 *));
-                        if (!lines) {
-                                log_oom();
-                                return FALSE;
-                        }
+                        lines = xnew(CHAR16*, config->entry_count + 1);
 
                         for (UINTN i = 0; i < config->entry_count; i++) {
                                 UINTN j, padding;
 
-                                lines[i] = AllocatePool(((line_width + 1) * sizeof(CHAR16)));
-                                if (!lines[i]) {
-                                        log_oom();
-                                        return FALSE;
-                                }
-
+                                lines[i] = xnew(CHAR16, line_width + 1);
                                 padding = (line_width - MIN(StrLen(config->entries[i]->title_show), line_width)) / 2;
 
                                 for (j = 0; j < padding; j++)
@@ -685,12 +672,7 @@ static BOOLEAN menu_run(
                         }
                         lines[config->entry_count] = NULL;
 
-                        clearline = AllocatePool((x_max+1) * sizeof(CHAR16));
-                        if (!clearline) {
-                                log_oom();
-                                return FALSE;
-                        }
-
+                        clearline = xnew(CHAR16, x_max + 1);
                         for (UINTN i = 0; i < x_max; i++)
                                 clearline[i] = ' ';
                         clearline[x_max] = 0;
@@ -728,7 +710,7 @@ static BOOLEAN menu_run(
 
                 if (timeout_remain > 0) {
                         FreePool(status);
-                        status = PoolPrint(L"Boot in %u s.", timeout_remain);
+                        status = xpool_print(L"Boot in %u s.", timeout_remain);
                 }
 
                 /* print status at last line of screen */
@@ -833,7 +815,7 @@ static BOOLEAN menu_run(
                 case KEYPRESS(0, 0, 'H'):
                 case KEYPRESS(0, 0, '?'):
                         /* This must stay below 80 characters! Q/v/Ctrl+l/f deliberately not advertised. */
-                        status = StrDuplicate(L"(d)efault (t/T)timeout (e)dit (r/R)resolution (p)rint (h)elp");
+                        status = xstrdup(L"(d)efault (t/T)timeout (e)dit (r/R)resolution (p)rint (h)elp");
                         break;
 
                 case KEYPRESS(0, 0, 'Q'):
@@ -845,17 +827,13 @@ static BOOLEAN menu_run(
                 case KEYPRESS(0, 0, 'D'):
                         if (config->idx_default_efivar != (INTN)idx_highlight) {
                                 FreePool(config->entry_default_efivar);
-                                config->entry_default_efivar = StrDuplicate(config->entries[idx_highlight]->id);
-                                if (!config->entry_default_efivar) {
-                                        log_oom();
-                                        return FALSE;
-                                }
+                                config->entry_default_efivar = xstrdup(config->entries[idx_highlight]->id);
                                 config->idx_default_efivar = idx_highlight;
-                                status = StrDuplicate(L"Default boot entry selected.");
+                                status = xstrdup(L"Default boot entry selected.");
                         } else {
                                 config->entry_default_efivar = mfree(config->entry_default_efivar);
                                 config->idx_default_efivar = -1;
-                                status = StrDuplicate(L"Default boot entry cleared.");
+                                status = xstrdup(L"Default boot entry cleared.");
                         }
                         config->use_saved_entry_efivar = FALSE;
                         refresh = TRUE;
@@ -887,9 +865,10 @@ static BOOLEAN menu_run(
                         break;
 
                 case KEYPRESS(0, 0, 'v'):
-                        status = PoolPrint(L"systemd-boot " GIT_VERSION " (" EFI_MACHINE_TYPE_NAME "), UEFI Specification %d.%02d, Vendor %s %d.%02d",
-                                           ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff,
-                                           ST->FirmwareVendor, ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff);
+                        status = xpool_print(L"systemd-boot " GIT_VERSION " (" EFI_MACHINE_TYPE_NAME "), "
+                                             L"UEFI Specification %d.%02d, Vendor %s %d.%02d",
+                                             ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff,
+                                             ST->FirmwareVendor, ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff);
                         break;
 
                 case KEYPRESS(0, 0, 'p'):
@@ -906,10 +885,10 @@ static BOOLEAN menu_run(
                 case KEYPRESS(0, 0, 'r'):
                         err = console_set_mode(CONSOLE_MODE_NEXT);
                         if (EFI_ERROR(err))
-                                status = PoolPrint(L"Error changing console mode: %r", err);
+                                status = xpool_print(L"Error changing console mode: %r", err);
                         else {
                                 config->console_mode_efivar = ST->ConOut->Mode->Mode;
-                                status = PoolPrint(L"Console mode changed to %ld.", config->console_mode_efivar);
+                                status = xpool_print(L"Console mode changed to %ld.", config->console_mode_efivar);
                         }
                         new_mode = TRUE;
                         break;
@@ -919,10 +898,10 @@ static BOOLEAN menu_run(
                         err = console_set_mode(config->console_mode == CONSOLE_MODE_KEEP ?
                                                console_mode_initial : config->console_mode);
                         if (EFI_ERROR(err))
-                                status = PoolPrint(L"Error resetting console mode: %r", err);
+                                status = xpool_print(L"Error resetting console mode: %r", err);
                         else
-                                status = PoolPrint(L"Console mode reset to %s default.",
-                                                   config->console_mode == CONSOLE_MODE_KEEP ? L"firmware" : L"configuration file");
+                                status = xpool_print(L"Console mode reset to %s default.",
+                                                     config->console_mode == CONSOLE_MODE_KEEP ? L"firmware" : L"configuration file");
                         new_mode = TRUE;
                         break;
 
@@ -935,9 +914,9 @@ static BOOLEAN menu_run(
                         if (FLAGS_SET(get_os_indications_supported(), EFI_OS_INDICATIONS_BOOT_TO_FW_UI)) {
                                 firmware_setup = TRUE;
                                 /* Let's make sure the user really wants to do this. */
-                                status = PoolPrint(L"Press Enter to reboot into firmware interface.");
+                                status = xpool_print(L"Press Enter to reboot into firmware interface.");
                         } else
-                                status = PoolPrint(L"Reboot into firmware interface not supported.");
+                                status = xpool_print(L"Reboot into firmware interface not supported.");
                         break;
 
                 default:
@@ -996,7 +975,7 @@ static void config_add_entry(Config *config, ConfigEntry *entry) {
 
         if ((config->entry_count & 15) == 0) {
                 UINTN i = config->entry_count + 16;
-                config->entries = ReallocatePool(
+                config->entries = xreallocate_pool(
                                 config->entries,
                                 sizeof(void *) * config->entry_count,
                                 sizeof(void *) * i);
@@ -1301,16 +1280,16 @@ good:
         entry->tries_left = left;
         entry->tries_done = done;
 
-        entry->path = StrDuplicate(path);
-        entry->current_name = StrDuplicate(file);
+        entry->path = xstrdup(path);
+        entry->current_name = xstrdup(file);
 
         next_left = left <= 0 ? 0 : left - 1;
         next_done = done >= (UINTN) -2 ? (UINTN) -2 : done + 1;
 
-        prefix = StrDuplicate(file);
+        prefix = xstrdup(file);
         prefix[i] = 0;
 
-        entry->next_name = PoolPrint(L"%s+%u-%u%s", prefix, next_left, next_done, suffix ?: L"");
+        entry->next_name = xpool_print(L"%s+%u-%u%s", prefix, next_left, next_done, suffix ?: L"");
 }
 
 static void config_entry_bump_counters(
@@ -1332,7 +1311,7 @@ static void config_entry_bump_counters(
         if (!entry->path || !entry->current_name || !entry->next_name)
                 return;
 
-        old_path = PoolPrint(L"%s\\%s", entry->path, entry->current_name);
+        old_path = xpool_print(L"%s\\%s", entry->path, entry->current_name);
 
         err = root_dir->Open(root_dir, &handle, old_path, EFI_FILE_MODE_READ|EFI_FILE_MODE_WRITE, 0ULL);
         if (EFI_ERROR(err))
@@ -1355,7 +1334,7 @@ static void config_entry_bump_counters(
 
         /* Let's tell the OS that we renamed this file, so that it knows what to rename to the counter-less name on
          * success */
-        new_path = PoolPrint(L"%s\\%s", entry->path, entry->next_name);
+        new_path = xpool_print(L"%s\\%s", entry->path, entry->next_name);
         efivar_set(LOADER_GUID, L"LoaderBootCountPath", new_path, 0);
 
         /* If the file we just renamed is the loader path, then let's update that. */
@@ -1389,8 +1368,7 @@ static void config_entry_add_from_file(
         assert(file);
         assert(content);
 
-        entry = AllocatePool(sizeof(ConfigEntry));
-
+        entry = xnew(ConfigEntry, 1);
         *entry = (ConfigEntry) {
                 .tries_done = UINTN_MAX,
                 .tries_left = UINTN_MAX,
@@ -1458,11 +1436,11 @@ static void config_entry_add_from_file(
                         if (initrd) {
                                 CHAR16 *s;
 
-                                s = PoolPrint(L"%s initrd=%s", initrd, new);
+                                s = xpool_print(L"%s initrd=%s", initrd, new);
                                 FreePool(initrd);
                                 initrd = s;
                         } else
-                                initrd = PoolPrint(L"initrd=%s", new);
+                                initrd = xpool_print(L"initrd=%s", new);
 
                         continue;
                 }
@@ -1474,7 +1452,7 @@ static void config_entry_add_from_file(
                         if (entry->options) {
                                 CHAR16 *s;
 
-                                s = PoolPrint(L"%s %s", entry->options, new);
+                                s = xpool_print(L"%s %s", entry->options, new);
                                 FreePool(entry->options);
                                 entry->options = s;
                         } else
@@ -1498,7 +1476,7 @@ static void config_entry_add_from_file(
                 if (entry->options) {
                         CHAR16 *s;
 
-                        s = PoolPrint(L"%s %s", initrd, entry->options);
+                        s = xpool_print(L"%s %s", initrd, entry->options);
                         FreePool(entry->options);
                         entry->options = s;
                 } else
@@ -1506,7 +1484,7 @@ static void config_entry_add_from_file(
         }
 
         entry->device = device;
-        entry->id = StrDuplicate(file);
+        entry->id = xstrdup(file);
         StrLwr(entry->id);
 
         config_add_entry(config, entry);
@@ -1735,7 +1713,7 @@ static void config_title_generate(Config *config) {
         /* set title */
         for (UINTN i = 0; i < config->entry_count; i++) {
                 FreePool(config->entries[i]->title_show);
-                config->entries[i]->title_show = StrDuplicate(
+                config->entries[i]->title_show = xstrdup(
                                 config->entries[i]->title ?: config->entries[i]->id);
         }
 
@@ -1751,7 +1729,7 @@ static void config_title_generate(Config *config) {
                 if (!config->entries[i]->version)
                         continue;
 
-                s = PoolPrint(L"%s (%s)", config->entries[i]->title_show, config->entries[i]->version);
+                s = xpool_print(L"%s (%s)", config->entries[i]->title_show, config->entries[i]->version);
                 FreePool(config->entries[i]->title_show);
                 config->entries[i]->title_show = s;
         }
@@ -1769,9 +1747,9 @@ static void config_title_generate(Config *config) {
                 if (!config->entries[i]->machine_id)
                         continue;
 
-                m = StrDuplicate(config->entries[i]->machine_id);
+                m = xstrdup(config->entries[i]->machine_id);
                 m[8] = '\0';
-                s = PoolPrint(L"%s (%s)", config->entries[i]->title_show, m);
+                s = xpool_print(L"%s (%s)", config->entries[i]->title_show, m);
                 FreePool(config->entries[i]->title_show);
                 config->entries[i]->title_show = s;
         }
@@ -1785,7 +1763,7 @@ static void config_title_generate(Config *config) {
 
                 if (!config->entries[i]->non_unique)
                         continue;
-                s = PoolPrint(L"%s (%s)", config->entries[i]->title_show, config->entries[i]->id);
+                s = xpool_print(L"%s (%s)", config->entries[i]->title_show, config->entries[i]->id);
                 FreePool(config->entries[i]->title_show);
                 config->entries[i]->title_show = s;
                 config->entries[i]->non_unique = FALSE;
@@ -1805,10 +1783,10 @@ static BOOLEAN config_entry_add_call(
         assert(title);
         assert(call);
 
-        entry = AllocatePool(sizeof(ConfigEntry));
+        entry = xnew(ConfigEntry, 1);
         *entry = (ConfigEntry) {
-                .id = StrDuplicate(id),
-                .title = StrDuplicate(title),
+                .id = xstrdup(id),
+                .title = xstrdup(title),
                 .call = call,
                 .no_autoselect = TRUE,
                 .tries_done = UINTN_MAX,
@@ -1837,14 +1815,14 @@ static ConfigEntry *config_entry_add_loader(
         assert(title);
         assert(loader);
 
-        entry = AllocatePool(sizeof(ConfigEntry));
+        entry = xnew(ConfigEntry, 1);
         *entry = (ConfigEntry) {
                 .type = type,
-                .title = StrDuplicate(title),
-                .version = version ? StrDuplicate(version) : NULL,
+                .title = xstrdup(title),
+                .version = version ? xstrdup(version) : NULL,
                 .device = device,
-                .loader = StrDuplicate(loader),
-                .id = StrDuplicate(id),
+                .loader = xstrdup(loader),
+                .id = xstrdup(id),
                 .key = key,
                 .tries_done = UINTN_MAX,
                 .tries_left = UINTN_MAX,
@@ -2139,10 +2117,7 @@ static void config_entry_add_linux(
                                     &good_version))
                         continue;
 
-                path = PoolPrint(L"\\EFI\\Linux\\%s", f->FileName);
-                if (!path)
-                        return (void) log_oom();
-
+                path = xpool_print(L"\\EFI\\Linux\\%s", f->FileName);
                 entry = config_entry_add_loader(
                                 config,
                                 device,
@@ -2152,8 +2127,6 @@ static void config_entry_add_linux(
                                 good_name,
                                 path,
                                 good_version);
-                if (!entry)
-                        return (void) log_oom();
 
                 config_entry_parse_tries(entry, L"\\EFI\\Linux", f->FileName, L".efi");
 
@@ -2273,7 +2246,7 @@ static void config_write_entries_to_variable(Config *config) {
         for (UINTN i = 0; i < config->entry_count; i++)
                 sz += StrSize(config->entries[i]->id);
 
-        p = buffer = AllocatePool(sz);
+        p = buffer = xallocate_pool(sz);
 
         for (UINTN i = 0; i < config->entry_count; i++) {
                 UINTN l;
@@ -2338,10 +2311,10 @@ static void export_variables(
         efivar_set_time_usec(LOADER_GUID, L"LoaderTimeInitUSec", init_usec);
         efivar_set(LOADER_GUID, L"LoaderInfo", L"systemd-boot " GIT_VERSION, 0);
 
-        infostr = PoolPrint(L"%s %d.%02d", ST->FirmwareVendor, ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff);
+        infostr = xpool_print(L"%s %d.%02d", ST->FirmwareVendor, ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff);
         efivar_set(LOADER_GUID, L"LoaderFirmwareInfo", infostr, 0);
 
-        typestr = PoolPrint(L"UEFI %d.%02d", ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff);
+        typestr = xpool_print(L"UEFI %d.%02d", ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff);
         efivar_set(LOADER_GUID, L"LoaderFirmwareType", typestr, 0);
 
         (void) efivar_set_uint64_le(LOADER_GUID, L"LoaderFeatures", loader_features, 0);

From 4f94341504b210aff70e6eae1b74f0e54f5bbdbc Mon Sep 17 00:00:00 2001
From: Jan Janssen <medhefgo@web.de>
Date: Mon, 15 Nov 2021 12:31:48 +0100
Subject: [PATCH 3/5] sd-boot: Make stra_to_path/stra_to_str non-failing

---
 src/boot/efi/boot.c  | 42 ++++++++++++++++++++----------------------
 src/boot/efi/linux.c |  8 ++------
 src/boot/efi/util.c  | 12 ++++--------
 src/boot/efi/util.h  |  4 ++--
 4 files changed, 28 insertions(+), 38 deletions(-)

diff --git a/src/boot/efi/boot.c b/src/boot/efi/boot.c
index 05aecabc8a..23f9980315 100644
--- a/src/boot/efi/boot.c
+++ b/src/boot/efi/boot.c
@@ -1096,7 +1096,7 @@ static void config_defaults_load_from_file(Config *config, CHAR8 *content) {
                         else {
                                 _cleanup_freepool_ CHAR16 *s = NULL;
 
-                                s = stra_to_str(value);
+                                s = xstra_to_str(value);
                                 config->timeout_sec_config = MIN(Atoi(s), TIMEOUT_TYPE_MAX);
                         }
                         config->timeout_sec = config->timeout_sec_config;
@@ -1109,7 +1109,7 @@ static void config_defaults_load_from_file(Config *config, CHAR8 *content) {
                                 continue;
                         }
                         FreePool(config->entry_default_config);
-                        config->entry_default_config = stra_to_str(value);
+                        config->entry_default_config = xstra_to_str(value);
                         continue;
                 }
 
@@ -1144,7 +1144,7 @@ static void config_defaults_load_from_file(Config *config, CHAR8 *content) {
                         else {
                                 _cleanup_freepool_ CHAR16 *s = NULL;
 
-                                s = stra_to_str(value);
+                                s = xstra_to_str(value);
                                 config->console_mode = MIN(Atoi(s), (UINTN)CONSOLE_MODE_RANGE_MAX);
                         }
 
@@ -1377,26 +1377,26 @@ static void config_entry_add_from_file(
         while ((line = line_get_key_value(content, (CHAR8 *)" \t", &pos, &key, &value))) {
                 if (strcmpa((CHAR8 *)"title", key) == 0) {
                         FreePool(entry->title);
-                        entry->title = stra_to_str(value);
+                        entry->title = xstra_to_str(value);
                         continue;
                 }
 
                 if (strcmpa((CHAR8 *)"version", key) == 0) {
                         FreePool(entry->version);
-                        entry->version = stra_to_str(value);
+                        entry->version = xstra_to_str(value);
                         continue;
                 }
 
                 if (strcmpa((CHAR8 *)"machine-id", key) == 0) {
                         FreePool(entry->machine_id);
-                        entry->machine_id = stra_to_str(value);
+                        entry->machine_id = xstra_to_str(value);
                         continue;
                 }
 
                 if (strcmpa((CHAR8 *)"linux", key) == 0) {
                         FreePool(entry->loader);
                         entry->type = LOADER_LINUX;
-                        entry->loader = stra_to_path(value);
+                        entry->loader = xstra_to_path(value);
                         entry->key = 'l';
                         continue;
                 }
@@ -1404,7 +1404,7 @@ static void config_entry_add_from_file(
                 if (strcmpa((CHAR8 *)"efi", key) == 0) {
                         entry->type = LOADER_EFI;
                         FreePool(entry->loader);
-                        entry->loader = stra_to_path(value);
+                        entry->loader = xstra_to_path(value);
 
                         /* do not add an entry for ourselves */
                         if (loaded_image_path && StriCmp(entry->loader, loaded_image_path) == 0) {
@@ -1425,14 +1425,14 @@ static void config_entry_add_from_file(
 
                 if (strcmpa((CHAR8 *)"devicetree", key) == 0) {
                         FreePool(entry->devicetree);
-                        entry->devicetree = stra_to_path(value);
+                        entry->devicetree = xstra_to_path(value);
                         continue;
                 }
 
                 if (strcmpa((CHAR8 *)"initrd", key) == 0) {
                         _cleanup_freepool_ CHAR16 *new = NULL;
 
-                        new = stra_to_path(value);
+                        new = xstra_to_path(value);
                         if (initrd) {
                                 CHAR16 *s;
 
@@ -1448,7 +1448,7 @@ static void config_entry_add_from_file(
                 if (strcmpa((CHAR8 *)"options", key) == 0) {
                         _cleanup_freepool_ CHAR16 *new = NULL;
 
-                        new = stra_to_str(value);
+                        new = xstra_to_str(value);
                         if (entry->options) {
                                 CHAR16 *s;
 
@@ -2057,49 +2057,49 @@ static void config_entry_add_linux(
                 while ((line = line_get_key_value(content, (CHAR8 *)"=", &pos, &key, &value))) {
                         if (strcmpa((const CHAR8*) "PRETTY_NAME", key) == 0) {
                                 FreePool(os_pretty_name);
-                                os_pretty_name = stra_to_str(value);
+                                os_pretty_name = xstra_to_str(value);
                                 continue;
                         }
 
                         if (strcmpa((const CHAR8*) "IMAGE_ID", key) == 0) {
                                 FreePool(os_image_id);
-                                os_image_id = stra_to_str(value);
+                                os_image_id = xstra_to_str(value);
                                 continue;
                         }
 
                         if (strcmpa((const CHAR8*) "NAME", key) == 0) {
                                 FreePool(os_name);
-                                os_name = stra_to_str(value);
+                                os_name = xstra_to_str(value);
                                 continue;
                         }
 
                         if (strcmpa((const CHAR8*) "ID", key) == 0) {
                                 FreePool(os_id);
-                                os_id = stra_to_str(value);
+                                os_id = xstra_to_str(value);
                                 continue;
                         }
 
                         if (strcmpa((const CHAR8*) "IMAGE_VERSION", key) == 0) {
                                 FreePool(os_image_version);
-                                os_image_version = stra_to_str(value);
+                                os_image_version = xstra_to_str(value);
                                 continue;
                         }
 
                         if (strcmpa((const CHAR8*) "VERSION", key) == 0) {
                                 FreePool(os_version);
-                                os_version = stra_to_str(value);
+                                os_version = xstra_to_str(value);
                                 continue;
                         }
 
                         if (strcmpa((const CHAR8*) "VERSION_ID", key) == 0) {
                                 FreePool(os_version_id);
-                                os_version_id = stra_to_str(value);
+                                os_version_id = xstra_to_str(value);
                                 continue;
                         }
 
                         if (strcmpa((const CHAR8*) "BUILD_ID", key) == 0) {
                                 FreePool(os_build_id);
-                                os_build_id = stra_to_str(value);
+                                os_build_id = xstra_to_str(value);
                                 continue;
                         }
                 }
@@ -2142,9 +2142,7 @@ static void config_entry_add_linux(
                         if (content[szs[SECTION_CMDLINE] - 1] == '\n')
                                 content[szs[SECTION_CMDLINE] - 1] = '\0';
 
-                        entry->options = stra_to_str(content);
-                        if (!entry->options)
-                                return (void) log_oom();
+                        entry->options = xstra_to_str(content);
                 }
         }
 }
diff --git a/src/boot/efi/linux.c b/src/boot/efi/linux.c
index c20ddbdfc6..8e3afb795b 100644
--- a/src/boot/efi/linux.c
+++ b/src/boot/efi/linux.c
@@ -46,13 +46,9 @@ static EFI_STATUS loaded_image_register(
                 .ImageSize = linux_length
         };
 
-        /* if a cmdline is set convert it to UTF16 */
+        /* if a cmdline is set convert it to UCS2 */
         if (cmdline) {
-                loaded_image->LoadOptions = stra_to_str(cmdline);
-                if (!loaded_image->LoadOptions) {
-                        loaded_image = loaded_image_free(loaded_image);
-                        return EFI_OUT_OF_RESOURCES;
-                }
+                loaded_image->LoadOptions = xstra_to_str(cmdline);
                 loaded_image->LoadOptionsSize = StrSize(loaded_image->LoadOptions);
         }
 
diff --git a/src/boot/efi/util.c b/src/boot/efi/util.c
index 4d981ca7e5..aa3c249562 100644
--- a/src/boot/efi/util.c
+++ b/src/boot/efi/util.c
@@ -358,7 +358,7 @@ static INTN utf8_to_16(const CHAR8 *stra, CHAR16 *c) {
         return len;
 }
 
-CHAR16 *stra_to_str(const CHAR8 *stra) {
+CHAR16 *xstra_to_str(const CHAR8 *stra) {
         UINTN strlen;
         UINTN len;
         UINTN i;
@@ -367,9 +367,7 @@ CHAR16 *stra_to_str(const CHAR8 *stra) {
         assert(stra);
 
         len = strlena(stra);
-        str = AllocatePool((len + 1) * sizeof(CHAR16));
-        if (!str)
-                return NULL;
+        str = xnew(CHAR16, len + 1);
 
         strlen = 0;
         i = 0;
@@ -390,7 +388,7 @@ CHAR16 *stra_to_str(const CHAR8 *stra) {
         return str;
 }
 
-CHAR16 *stra_to_path(const CHAR8 *stra) {
+CHAR16 *xstra_to_path(const CHAR8 *stra) {
         CHAR16 *str;
         UINTN strlen;
         UINTN len;
@@ -399,9 +397,7 @@ CHAR16 *stra_to_path(const CHAR8 *stra) {
         assert(stra);
 
         len = strlena(stra);
-        str = AllocatePool((len + 2) * sizeof(CHAR16));
-        if (!str)
-                return NULL;
+        str = xnew(CHAR16, len + 2);
 
         str[0] = '\\';
         strlen = 1;
diff --git a/src/boot/efi/util.h b/src/boot/efi/util.h
index 9505d3bf21..d5f32dbb38 100644
--- a/src/boot/efi/util.h
+++ b/src/boot/efi/util.h
@@ -68,8 +68,8 @@ EFI_STATUS efivar_get_uint64_le(const EFI_GUID *vendor, const CHAR16 *name, UINT
 EFI_STATUS efivar_get_boolean_u8(const EFI_GUID *vendor, const CHAR16 *name, BOOLEAN *ret);
 
 CHAR8 *strchra(const CHAR8 *s, CHAR8 c);
-CHAR16 *stra_to_path(const CHAR8 *stra);
-CHAR16 *stra_to_str(const CHAR8 *stra);
+CHAR16 *xstra_to_path(const CHAR8 *stra);
+CHAR16 *xstra_to_str(const CHAR8 *stra);
 
 EFI_STATUS file_read(EFI_FILE_HANDLE dir, const CHAR16 *name, UINTN off, UINTN size, CHAR8 **content, UINTN *content_size);
 

From ccfbdbdcabd194bb14148a4f26cf4b3128a5bbf7 Mon Sep 17 00:00:00 2001
From: Jan Janssen <medhefgo@web.de>
Date: Mon, 15 Nov 2021 12:48:47 +0100
Subject: [PATCH 4/5] sd-boot: Simplify path creation

---
 src/boot/efi/cpio.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/src/boot/efi/cpio.c b/src/boot/efi/cpio.c
index 1818fbedd0..109003e9de 100644
--- a/src/boot/efi/cpio.c
+++ b/src/boot/efi/cpio.c
@@ -330,7 +330,7 @@ EFI_STATUS pack_cpio(
 
         _cleanup_(FileHandleClosep) EFI_FILE_HANDLE root = NULL, extra_dir = NULL;
         UINTN dirent_size = 0, buffer_size = 0, n_items = 0, n_allocated = 0;
-        _cleanup_freepool_ CHAR16 *loaded_image_path = NULL, *j = NULL;
+        _cleanup_freepool_ CHAR16 *extra_dir_path = NULL;
         _cleanup_freepool_ EFI_FILE_INFO *dirent = NULL;
         _cleanup_(strv_freep) CHAR16 **items = NULL;
         _cleanup_freepool_ void *buffer = NULL;
@@ -346,15 +346,11 @@ EFI_STATUS pack_cpio(
         if (!root)
                 return log_error_status_stall(EFI_LOAD_ERROR, L"Unable to open root directory.");
 
-        loaded_image_path = DevicePathToStr(loaded_image->FilePath);
-        if (!loaded_image_path)
+        extra_dir_path = PoolPrint(L"%D" EXTRA_DIR_SUFFIX, loaded_image->FilePath);
+        if (!extra_dir_path)
                 return log_oom();
 
-        j = PoolPrint(L"%s" EXTRA_DIR_SUFFIX, loaded_image_path);
-        if (!j)
-                return log_oom();
-
-        err = open_directory(root, j, &extra_dir);
+        err = open_directory(root, extra_dir_path, &extra_dir);
         if (err == EFI_NOT_FOUND) {
                 /* No extra subdir, that's totally OK */
                 *ret_buffer = NULL;

From 0a15a824d2505f2a5657075c7ab888f28b39fc0a Mon Sep 17 00:00:00 2001
From: Jan Janssen <medhefgo@web.de>
Date: Wed, 17 Nov 2021 11:11:23 +0100
Subject: [PATCH 5/5] sd-boot: Use non-failing allocators everywhere else

---
 src/boot/efi/cpio.c        | 33 ++++++----------------------
 src/boot/efi/drivers.c     |  5 +----
 src/boot/efi/initrd.c      |  6 ++----
 src/boot/efi/linux.c       |  6 +-----
 src/boot/efi/measure.c     | 10 ++-------
 src/boot/efi/pe.c          |  2 +-
 src/boot/efi/random-seed.c | 12 +++--------
 src/boot/efi/splash.c      |  6 +-----
 src/boot/efi/stub.c        | 20 +++++------------
 src/boot/efi/util.c        | 44 ++++++++------------------------------
 src/boot/efi/util.h        |  2 +-
 src/boot/efi/xbootldr.c    |  8 ++-----
 12 files changed, 35 insertions(+), 119 deletions(-)

diff --git a/src/boot/efi/cpio.c b/src/boot/efi/cpio.c
index 109003e9de..d7dd50fc8f 100644
--- a/src/boot/efi/cpio.c
+++ b/src/boot/efi/cpio.c
@@ -113,9 +113,7 @@ static EFI_STATUS pack_cpio_one(
 
         if (*cpio_buffer_size > UINTN_MAX - l) /* overflow check */
                 return EFI_OUT_OF_RESOURCES;
-        a = ReallocatePool(*cpio_buffer, *cpio_buffer_size, *cpio_buffer_size + l);
-        if (!a)
-                return EFI_OUT_OF_RESOURCES;
+        a = xreallocate_pool(*cpio_buffer, *cpio_buffer_size, *cpio_buffer_size + l);
 
         *cpio_buffer = a;
         a = (CHAR8*) *cpio_buffer + *cpio_buffer_size;
@@ -198,11 +196,8 @@ static EFI_STATUS pack_cpio_dir(
 
         if (*cpio_buffer_size > UINTN_MAX - l) /* overflow check */
                 return EFI_OUT_OF_RESOURCES;
-        a = ReallocatePool(*cpio_buffer, *cpio_buffer_size, *cpio_buffer_size + l);
-        if (!a)
-                return EFI_OUT_OF_RESOURCES;
 
-        *cpio_buffer = a;
+        *cpio_buffer = a = xreallocate_pool(*cpio_buffer, *cpio_buffer_size, *cpio_buffer_size + l);
         a = (CHAR8*) *cpio_buffer + *cpio_buffer_size;
 
         CopyMem(a, "070701", 6); /* magic ID */
@@ -262,7 +257,7 @@ static EFI_STATUS pack_cpio_prefix(
                 if (e > p) {
                         _cleanup_freepool_ CHAR8 *t = NULL;
 
-                        t = strndup8(path, e - path);
+                        t = xstrndup8(path, e - path);
                         if (!t)
                                 return EFI_OUT_OF_RESOURCES;
 
@@ -298,19 +293,13 @@ static EFI_STATUS pack_cpio_trailer(
                 "00000000"
                 "TRAILER!!!\0\0\0"; /* There's a fourth NUL byte appended here, because this is a string */
 
-        void *a;
-
         /* Generates the cpio trailer record that indicates the end of our initrd cpio archive */
 
         assert(cpio_buffer);
         assert(cpio_buffer_size);
         assert_cc(sizeof(trailer) % 4 == 0);
 
-        a = ReallocatePool(*cpio_buffer, *cpio_buffer_size, *cpio_buffer_size + sizeof(trailer));
-        if (!a)
-                return EFI_OUT_OF_RESOURCES;
-
-        *cpio_buffer = a;
+        *cpio_buffer = xreallocate_pool(*cpio_buffer, *cpio_buffer_size, *cpio_buffer_size + sizeof(trailer));
         CopyMem((UINT8*) *cpio_buffer + *cpio_buffer_size, trailer, sizeof(trailer));
         *cpio_buffer_size += sizeof(trailer);
 
@@ -346,10 +335,7 @@ EFI_STATUS pack_cpio(
         if (!root)
                 return log_error_status_stall(EFI_LOAD_ERROR, L"Unable to open root directory.");
 
-        extra_dir_path = PoolPrint(L"%D" EXTRA_DIR_SUFFIX, loaded_image->FilePath);
-        if (!extra_dir_path)
-                return log_oom();
-
+        extra_dir_path = xpool_print(L"%D" EXTRA_DIR_SUFFIX, loaded_image->FilePath);
         err = open_directory(root, extra_dir_path, &extra_dir);
         if (err == EFI_NOT_FOUND) {
                 /* No extra subdir, that's totally OK */
@@ -380,9 +366,7 @@ EFI_STATUS pack_cpio(
                 if (StrLen(dirent->FileName) > 255) /* Max filename size on Linux */
                         continue;
 
-                d = StrDuplicate(dirent->FileName);
-                if (!d)
-                        return log_oom();
+                d = xstrdup(dirent->FileName);
 
                 if (n_items+2 > n_allocated) {
                         UINTN m;
@@ -392,10 +376,7 @@ EFI_STATUS pack_cpio(
                                 return log_oom();
 
                         m = n_items + 16;
-                        items = ReallocatePool(items, n_allocated * sizeof(UINT16*), m * sizeof(UINT16*));
-                        if (!items)
-                                return log_oom();
-
+                        items = xreallocate_pool(items, n_allocated * sizeof(UINT16*), m * sizeof(UINT16*));
                         n_allocated = m;
                 }
 
diff --git a/src/boot/efi/drivers.c b/src/boot/efi/drivers.c
index 4bb4dedaa0..ce5cf3dcd7 100644
--- a/src/boot/efi/drivers.c
+++ b/src/boot/efi/drivers.c
@@ -25,10 +25,7 @@ static EFI_STATUS load_one_driver(
         assert(loaded_image);
         assert(fname);
 
-        spath = PoolPrint(L"\\EFI\\systemd\\drivers\\%s", fname);
-        if (!spath)
-                return log_oom();
-
+        spath = xpool_print(L"\\EFI\\systemd\\drivers\\%s", fname);
         path = FileDevicePath(loaded_image->DeviceHandle, spath);
         if (!path)
                 return log_oom();
diff --git a/src/boot/efi/initrd.c b/src/boot/efi/initrd.c
index 4475a3d5ee..3136d3b8fa 100644
--- a/src/boot/efi/initrd.c
+++ b/src/boot/efi/initrd.c
@@ -6,6 +6,7 @@
 #include "initrd.h"
 #include "macro-fundamental.h"
 #include "missing_efi.h"
+#include "util.h"
 
 /* extend LoadFileProtocol */
 struct initrd_loader {
@@ -88,10 +89,7 @@ EFI_STATUS initrd_register(
         if (err != EFI_NOT_FOUND) /* InitrdMedia is already registered */
                 return EFI_ALREADY_STARTED;
 
-        loader = AllocatePool(sizeof(struct initrd_loader));
-        if (!loader)
-                return EFI_OUT_OF_RESOURCES;
-
+        loader = xnew(struct initrd_loader, 1);
         *loader = (struct initrd_loader) {
                 .load_file.LoadFile = initrd_load_file,
                 .address = initrd_address,
diff --git a/src/boot/efi/linux.c b/src/boot/efi/linux.c
index 8e3afb795b..ce0f4985c0 100644
--- a/src/boot/efi/linux.c
+++ b/src/boot/efi/linux.c
@@ -36,11 +36,7 @@ static EFI_STATUS loaded_image_register(
         assert(ret_image);
 
         /* create and install new LoadedImage Protocol */
-        loaded_image = AllocatePool(sizeof(EFI_LOADED_IMAGE));
-        if (!loaded_image)
-                return EFI_OUT_OF_RESOURCES;
-
-        /* provide the image base address and size */
+        loaded_image = xnew(EFI_LOADED_IMAGE, 1);
         *loaded_image = (EFI_LOADED_IMAGE) {
                 .ImageBase = (void *) linux_buffer,
                 .ImageSize = linux_length
diff --git a/src/boot/efi/measure.c b/src/boot/efi/measure.c
index 220a8fbb35..4b6e8776ca 100644
--- a/src/boot/efi/measure.c
+++ b/src/boot/efi/measure.c
@@ -26,10 +26,7 @@ static EFI_STATUS tpm1_measure_to_pcr_and_event_log(
         assert(description);
 
         desc_len = StrSize(description);
-        tcg_event = AllocateZeroPool(OFFSETOF(TCG_PCR_EVENT, Event) + desc_len);
-        if (!tcg_event)
-                return EFI_OUT_OF_RESOURCES;
-
+        tcg_event = xallocate_zero_pool(OFFSETOF(TCG_PCR_EVENT, Event) + desc_len);
         *tcg_event = (TCG_PCR_EVENT) {
                 .EventSize = desc_len,
                 .PCRIndex = pcrindex,
@@ -60,10 +57,7 @@ static EFI_STATUS tpm2_measure_to_pcr_and_event_log(
         assert(description);
 
         desc_len = StrSize(description);
-        tcg_event = AllocateZeroPool(OFFSETOF(EFI_TCG2_EVENT, Event) + desc_len);
-        if (!tcg_event)
-                return EFI_OUT_OF_RESOURCES;
-
+        tcg_event = xallocate_zero_pool(OFFSETOF(EFI_TCG2_EVENT, Event) + desc_len);
         *tcg_event = (EFI_TCG2_EVENT) {
                 .Size = OFFSETOF(EFI_TCG2_EVENT, Event) + desc_len,
                 .Header.HeaderSize = sizeof(EFI_TCG2_EVENT_HEADER),
diff --git a/src/boot/efi/pe.c b/src/boot/efi/pe.c
index e87b720dfa..91e7529fb1 100644
--- a/src/boot/efi/pe.c
+++ b/src/boot/efi/pe.c
@@ -259,7 +259,7 @@ EFI_STATUS pe_file_locate_sections(
                 return EFI_LOAD_ERROR;
 
         section_table_len = pe.FileHeader.NumberOfSections * sizeof(struct PeSectionHeader);
-        section_table = AllocatePool(section_table_len);
+        section_table = xallocate_pool(section_table_len);
         if (!section_table)
                 return EFI_OUT_OF_RESOURCES;
 
diff --git a/src/boot/efi/random-seed.c b/src/boot/efi/random-seed.c
index e829cf98b1..ecfd8a6b51 100644
--- a/src/boot/efi/random-seed.c
+++ b/src/boot/efi/random-seed.c
@@ -32,9 +32,7 @@ static EFI_STATUS acquire_rng(UINTN size, void **ret) {
         if (!rng)
                 return EFI_UNSUPPORTED;
 
-        data = AllocatePool(size);
-        if (!data)
-                return log_oom();
+        data = xallocate_pool(size);
 
         err = rng->GetRNG(rng, NULL, size, data);
         if (EFI_ERROR(err))
@@ -99,9 +97,7 @@ static EFI_STATUS hash_many(
         /* Hashes the specified parameters in counter mode, generating n hash values, with the counter in the
          * range counter_start…counter_start+n-1. */
 
-        output = AllocatePool(n * HASH_VALUE_SIZE);
-        if (!output)
-                return log_oom();
+        output = xallocate_pool(n * HASH_VALUE_SIZE);
 
         for (UINTN i = 0; i < n; i++)
                 hash_once(old_seed, rng, size,
@@ -274,9 +270,7 @@ EFI_STATUS process_random_seed(EFI_FILE *root_dir, RandomSeedMode mode) {
         if (size > RANDOM_MAX_SIZE_MAX)
                 return log_error_status_stall(EFI_INVALID_PARAMETER, L"Random seed file is too large.");
 
-        seed = AllocatePool(size);
-        if (!seed)
-                return log_oom();
+        seed = xallocate_pool(size);
 
         rsize = size;
         err = handle->Read(handle, &rsize, seed);
diff --git a/src/boot/efi/splash.c b/src/boot/efi/splash.c
index fa923e77f2..71bd008d96 100644
--- a/src/boot/efi/splash.c
+++ b/src/boot/efi/splash.c
@@ -260,7 +260,6 @@ EFI_STATUS graphics_splash(const UINT8 *content, UINTN len, const EFI_GRAPHICS_O
         struct bmp_dib *dib;
         struct bmp_map *map;
         const UINT8 *pixmap;
-        UINT64 blt_size;
         _cleanup_freepool_ void *blt = NULL;
         UINTN x_pos = 0;
         UINTN y_pos = 0;
@@ -302,10 +301,7 @@ EFI_STATUS graphics_splash(const UINT8 *content, UINTN len, const EFI_GRAPHICS_O
                 return err;
 
         /* EFI buffer */
-        blt_size = sizeof(EFI_GRAPHICS_OUTPUT_BLT_PIXEL) * dib->x * dib->y;
-        blt = AllocatePool(blt_size);
-        if (!blt)
-                return EFI_OUT_OF_RESOURCES;
+        blt = xnew(EFI_GRAPHICS_OUTPUT_BLT_PIXEL, dib->x * dib->y);
 
         err = GraphicsOutput->Blt(
                         GraphicsOutput, blt,
diff --git a/src/boot/efi/stub.c b/src/boot/efi/stub.c
index 4de23792b5..c99b3b7d6d 100644
--- a/src/boot/efi/stub.c
+++ b/src/boot/efi/stub.c
@@ -119,23 +119,15 @@ static void export_variables(EFI_LOADED_IMAGE *loaded_image) {
         /* if LoaderFirmwareInfo is not set, let's set it */
         if (efivar_get_raw(LOADER_GUID, L"LoaderFirmwareInfo", NULL, NULL) != EFI_SUCCESS) {
                 _cleanup_freepool_ CHAR16 *s = NULL;
-
-                s = PoolPrint(L"%s %d.%02d", ST->FirmwareVendor, ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff);
-                if (s)
-                        efivar_set(LOADER_GUID, L"LoaderFirmwareInfo", s, 0);
-                else
-                        log_oom();
+                s = xpool_print(L"%s %d.%02d", ST->FirmwareVendor, ST->FirmwareRevision >> 16, ST->FirmwareRevision & 0xffff);
+                efivar_set(LOADER_GUID, L"LoaderFirmwareInfo", s, 0);
         }
 
         /* ditto for LoaderFirmwareType */
         if (efivar_get_raw(LOADER_GUID, L"LoaderFirmwareType", NULL, NULL) != EFI_SUCCESS) {
                 _cleanup_freepool_ CHAR16 *s = NULL;
-
-                s = PoolPrint(L"UEFI %d.%02d", ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff);
-                if (s)
-                        efivar_set(LOADER_GUID, L"LoaderFirmwareType", s, 0);
-                else
-                        log_oom();
+                s = xpool_print(L"UEFI %d.%02d", ST->Hdr.Revision >> 16, ST->Hdr.Revision & 0xffff);
+                efivar_set(LOADER_GUID, L"LoaderFirmwareType", s, 0);
         }
 
         /* add StubInfo */
@@ -206,9 +198,7 @@ EFI_STATUS efi_main(EFI_HANDLE image, EFI_SYSTEM_TABLE *sys_table) {
         if ((!secure_boot_enabled() || cmdline_len == 0) && loaded_image->LoadOptionsSize > 0 &&
             *(CHAR16 *) loaded_image->LoadOptions > 0x1F) {
                 cmdline_len = (loaded_image->LoadOptionsSize / sizeof(CHAR16)) * sizeof(CHAR8);
-                cmdline = cmdline_owned = AllocatePool(cmdline_len);
-                if (!cmdline)
-                        return log_oom();
+                cmdline = cmdline_owned = xallocate_pool(cmdline_len);
 
                 for (UINTN i = 0; i < cmdline_len; i++)
                         cmdline[i] = ((CHAR16 *) loaded_image->LoadOptions)[i];
diff --git a/src/boot/efi/util.c b/src/boot/efi/util.c
index aa3c249562..04e390b0fa 100644
--- a/src/boot/efi/util.c
+++ b/src/boot/efi/util.c
@@ -180,9 +180,7 @@ EFI_STATUS efivar_get(const EFI_GUID *vendor, const CHAR16 *name, CHAR16 **value
         }
 
         /* Make sure a terminating NUL is available at the end */
-        val = AllocatePool(size + sizeof(CHAR16));
-        if (!val)
-                return EFI_OUT_OF_RESOURCES;
+        val = xallocate_pool(size + sizeof(CHAR16));
 
         CopyMem(val, buf, size);
         val[size / sizeof(CHAR16)] = 0; /* NUL terminate */
@@ -256,9 +254,7 @@ EFI_STATUS efivar_get_raw(const EFI_GUID *vendor, const CHAR16 *name, CHAR8 **bu
         assert(name);
 
         l = sizeof(CHAR16 *) * EFI_MAXIMUM_VARIABLE_SIZE;
-        buf = AllocatePool(l);
-        if (!buf)
-                return EFI_OUT_OF_RESOURCES;
+        buf = xallocate_pool(l);
 
         err = RT->GetVariable((CHAR16 *) name, (EFI_GUID *) vendor, NULL, &l, buf);
         if (!EFI_ERROR(err)) {
@@ -467,10 +463,7 @@ EFI_STATUS file_read(EFI_FILE_HANDLE dir, const CHAR16 *name, UINTN off, UINTN s
                         return err;
         }
 
-        buf = AllocatePool(size + 1);
-        if (!buf)
-                return EFI_OUT_OF_RESOURCES;
-
+        buf = xallocate_pool(size + 1);
         err = handle->Read(handle, &size, buf);
         if (EFI_ERROR(err))
                 return err;
@@ -582,17 +575,11 @@ EFI_STATUS get_file_info_harder(
 
         /* A lot like LibFileInfo() but with useful error propagation */
 
-        fi = AllocatePool(size);
-        if (!fi)
-                return EFI_OUT_OF_RESOURCES;
-
+        fi = xallocate_pool(size);
         err = handle->GetInfo(handle, &GenericFileInfo, &size, fi);
         if (err == EFI_BUFFER_TOO_SMALL) {
                 FreePool(fi);
-                fi = AllocatePool(size);  /* GetInfo tells us the required size, let's use that now */
-                if (!fi)
-                        return EFI_OUT_OF_RESOURCES;
-
+                fi = xallocate_pool(size);  /* GetInfo tells us the required size, let's use that now */
                 err = handle->GetInfo(handle, &GenericFileInfo, &size, fi);
         }
 
@@ -624,11 +611,7 @@ EFI_STATUS readdir_harder(
 
         if (!*buffer) {
                 sz = OFFSETOF(EFI_FILE_INFO, FileName) /* + 256 */;
-
-                *buffer = AllocatePool(sz);
-                if (!*buffer)
-                        return EFI_OUT_OF_RESOURCES;
-
+                *buffer = xallocate_pool(sz);
                 *buffer_size = sz;
         } else
                 sz = *buffer_size;
@@ -636,15 +619,8 @@ EFI_STATUS readdir_harder(
         err = handle->Read(handle, &sz, *buffer);
         if (err == EFI_BUFFER_TOO_SMALL) {
                 FreePool(*buffer);
-
-                *buffer = AllocatePool(sz);
-                if (!*buffer) {
-                        *buffer_size = 0;
-                        return EFI_OUT_OF_RESOURCES;
-                }
-
+                *buffer = xallocate_pool(sz);
                 *buffer_size = sz;
-
                 err = handle->Read(handle, &sz, *buffer);
         }
         if (EFI_ERROR(err))
@@ -673,7 +649,7 @@ UINTN strnlena(const CHAR8 *p, UINTN maxlen) {
         return c;
 }
 
-CHAR8 *strndup8(const CHAR8 *p, UINTN sz) {
+CHAR8 *xstrndup8(const CHAR8 *p, UINTN sz) {
         CHAR8 *n;
 
         /* Following efilib's naming scheme this function would be called strndupa(), but we already have a
@@ -684,9 +660,7 @@ CHAR8 *strndup8(const CHAR8 *p, UINTN sz) {
 
         sz = strnlena(p, sz);
 
-        n = AllocatePool(sz + 1);
-        if (!n)
-                return NULL;
+        n = xallocate_pool(sz + 1);
 
         if (sz > 0)
                 CopyMem(n, p, sz);
diff --git a/src/boot/efi/util.h b/src/boot/efi/util.h
index d5f32dbb38..425d25d73f 100644
--- a/src/boot/efi/util.h
+++ b/src/boot/efi/util.h
@@ -129,7 +129,7 @@ EFI_STATUS get_file_info_harder(EFI_FILE_HANDLE handle, EFI_FILE_INFO **ret, UIN
 EFI_STATUS readdir_harder(EFI_FILE_HANDLE handle, EFI_FILE_INFO **buffer, UINTN *buffer_size);
 
 UINTN strnlena(const CHAR8 *p, UINTN maxlen);
-CHAR8 *strndup8(const CHAR8 *p, UINTN sz);
+CHAR8 *xstrndup8(const CHAR8 *p, UINTN sz);
 
 BOOLEAN is_ascii(const CHAR16 *f);
 
diff --git a/src/boot/efi/xbootldr.c b/src/boot/efi/xbootldr.c
index 39c3c99d6e..81aa7f61ee 100644
--- a/src/boot/efi/xbootldr.c
+++ b/src/boot/efi/xbootldr.c
@@ -20,9 +20,7 @@ static EFI_DEVICE_PATH *path_parent(EFI_DEVICE_PATH *path, EFI_DEVICE_PATH *node
         assert(node);
 
         len = (UINT8*) NextDevicePathNode(node) - (UINT8*) path;
-        parent = (EFI_DEVICE_PATH*) AllocatePool(len + sizeof(EFI_DEVICE_PATH));
-        if (!parent)
-                return NULL;
+        parent = (EFI_DEVICE_PATH*) xallocate_pool(len + sizeof(EFI_DEVICE_PATH));
 
         CopyMem(parent, path, len);
         CopyMem((UINT8*) parent + len, EndDevicePath, sizeof(EFI_DEVICE_PATH));
@@ -112,9 +110,7 @@ static EFI_STATUS try_gpt(
 
         /* Now load the GPT entry table */
         size = ALIGN_TO((UINTN) gpt.gpt_header.SizeOfPartitionEntry * (UINTN) gpt.gpt_header.NumberOfPartitionEntries, 512);
-        entries = AllocatePool(size);
-        if (!entries)
-                return EFI_OUT_OF_RESOURCES;
+        entries = xallocate_pool(size);
 
         err = block_io->ReadBlocks(
                         block_io,