redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity

hfsplus: validate btree flags 

Signed-off-by: Christoph Hellwig <hch@tuxera.com>
wifi-calibration
Christoph Hellwig 2010-10-14 09:54:23 -04:00 committed by Christoph Hellwig
parent 9250f92597
commit 13571a6977
2 changed files with 20 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
fs/hfsplus/brec.c
View File

@ -42,20 +42,12 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
if (!recoff)
return 0;
if (node->tree->attributes & HFS_TREE_BIGKEYS) {
retval = hfs_bnode_read_u16(node, recoff) + 2;
if (retval > node->tree->max_key_len + 2) {
printk(KERN_ERR "hfs: keylen %d too large\n",
retval);
retval = 0;
}
} else {
retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
if (retval > node->tree->max_key_len + 1) {
printk(KERN_ERR "hfs: keylen %d too large\n",
retval);
retval = 0;
}
retval = hfs_bnode_read_u16(node, recoff) + 2;
if (retval > node->tree->max_key_len + 2) {
printk(KERN_ERR "hfs: keylen %d too large\n",
retval);
retval = 0;
}
}
return retval;

14
fs/hfsplus/btree.c
View File

@ -71,6 +71,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
tree->max_key_len);
goto fail_page;
}
if (tree->attributes & HFS_TREE_VARIDXKEYS) {
printk(KERN_ERR "hfs: invalid extent btree flag\n");
goto fail_page;
}
tree->keycmp = hfsplus_ext_cmp_key;
break;
case HFSPLUS_CAT_CNID:
@ -79,6 +84,10 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
tree->max_key_len);
goto fail_page;
}
if (!(tree->attributes & HFS_TREE_VARIDXKEYS)) {
printk(KERN_ERR "hfs: invalid catalog btree flag\n");
goto fail_page;
}
if (test_bit(HFSPLUS_SB_HFSX, &HFSPLUS_SB(sb)->flags) &&
(head->key_type == HFSPLUS_KEY_BINARY))
@ -93,6 +102,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
goto fail_page;
}
if (!(tree->attributes & HFS_TREE_BIGKEYS)) {
printk(KERN_ERR "hfs: invalid btree flag\n");
goto fail_page;
}
size = tree->node_size;
if (!is_power_of_2(size))
goto fail_page;