hfs: handle more on-disk corruptions without oopsing

[deliverable/linux.git] / fs / hfs / brec.c

diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
index 5c87cf4801fcb00f05311d2883c9977dbfa5ef2f..8626ee375ea811d3a4e794a5f72a05d96b09bea0 100644 (file)
--- a/fs/hfs/brec.c
+++ b/fs/hfs/brec.c
@@ -44,10 +44,21 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
                recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
                if (!recoff)
                        return 0;
-               if (node->tree->attributes & HFS_TREE_BIGKEYS)
+               if (node->tree->attributes & HFS_TREE_BIGKEYS) {
                        retval = hfs_bnode_read_u16(node, recoff) + 2;
-               else
+                       if (retval > node->tree->max_key_len + 2) {
+                               printk(KERN_ERR "hfs: keylen %d too large\n",
+                                       retval);
+                               retval = HFS_BAD_KEYLEN;
+                       }
+               } else {
                        retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
+                       if (retval > node->tree->max_key_len + 1) {
+                               printk(KERN_ERR "hfs: keylen %d too large\n",
+                                       retval);
+                               retval = HFS_BAD_KEYLEN;
+                       }
+               }
        }
        return retval;
 }