hfsplus: validate btree flags

Signed-off-by: Christoph Hellwig <hch@tuxera.com>

diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
index 790cd6a8605df7fae4838eb14973e1dd00005b37..2f39d05443e1a374b197359f70d20337562aa9e8 100644 (file)
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -42,20 +42,12 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
                recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
                if (!recoff)
                        return 0;
-               if (node->tree->attributes & HFS_TREE_BIGKEYS) {
-                       retval = hfs_bnode_read_u16(node, recoff) + 2;
-                       if (retval > node->tree->max_key_len + 2) {
-                               printk(KERN_ERR "hfs: keylen %d too large\n",
-                                       retval);
-                               retval = 0;
-                       }
-               } else {
-                       retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
-                       if (retval > node->tree->max_key_len + 1) {
-                               printk(KERN_ERR "hfs: keylen %d too large\n",
-                                       retval);
-                               retval = 0;
-                       }
+
+               retval = hfs_bnode_read_u16(node, recoff) + 2;
+               if (retval > node->tree->max_key_len + 2) {
+                       printk(KERN_ERR "hfs: keylen %d too large\n",
+                               retval);
+                       retval = 0;
                }
        }
        return retval;

diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 82caff215e084fc9a0344b05cd750be5ec4ad084..22e4d4e329999c3ba9848036a3639bc194598f74 100644 (file)
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -71,6 +71,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                                tree->max_key_len);
                        goto fail_page;
                }
+               if (tree->attributes & HFS_TREE_VARIDXKEYS) {
+                       printk(KERN_ERR "hfs: invalid extent btree flag\n");
+                       goto fail_page;
+               }
+
                tree->keycmp = hfsplus_ext_cmp_key;
                break;
        case HFSPLUS_CAT_CNID:
@@ -79,6 +84,10 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                                tree->max_key_len);
                        goto fail_page;
                }
+               if (!(tree->attributes & HFS_TREE_VARIDXKEYS)) {
+                       printk(KERN_ERR "hfs: invalid catalog btree flag\n");
+                       goto fail_page;
+               }
 
                if (test_bit(HFSPLUS_SB_HFSX, &HFSPLUS_SB(sb)->flags) &&
                    (head->key_type == HFSPLUS_KEY_BINARY))
@@ -93,6 +102,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                goto fail_page;
        }
 
+       if (!(tree->attributes & HFS_TREE_BIGKEYS)) {
+               printk(KERN_ERR "hfs: invalid btree flag\n");
+               goto fail_page;
+       }
+
        size = tree->node_size;
        if (!is_power_of_2(size))
                goto fail_page;