hfsplus: validate btree flags

Signed-off-by: Christoph Hellwig <hch@tuxera.com>

2 files changed, 20 insertions, 14 deletions

diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
index 790cd6a8605d..2f39d05443e1 100644
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -42,20 +42,12 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
                 recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
                 if (!recoff)
                         return 0;
-                if (node->tree->attributes & HFS_TREE_BIGKEYS) {
-                        retval = hfs_bnode_read_u16(node, recoff) + 2;
-                        if (retval > node->tree->max_key_len + 2) {
-                                printk(KERN_ERR "hfs: keylen %d too large\n",
-                                        retval);
-                                retval = 0;
-                        }
-                } else {
-                        retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
-                        if (retval > node->tree->max_key_len + 1) {
-                                printk(KERN_ERR "hfs: keylen %d too large\n",
-                                        retval);
-                                retval = 0;
-                        }
+
+                retval = hfs_bnode_read_u16(node, recoff) + 2;
+                if (retval > node->tree->max_key_len + 2) {
+                        printk(KERN_ERR "hfs: keylen %d too large\n",
+                                retval);
+                        retval = 0;
                 }
         }
         return retval;
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 82caff215e08..22e4d4e32999 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -71,6 +71,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                                 tree->max_key_len);
                         goto fail_page;
                 }
+                if (tree->attributes & HFS_TREE_VARIDXKEYS) {
+                        printk(KERN_ERR "hfs: invalid extent btree flag\n");
+                        goto fail_page;
+                }
+
                 tree->keycmp = hfsplus_ext_cmp_key;
                 break;
         case HFSPLUS_CAT_CNID:
@@ -79,6 +84,10 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                                 tree->max_key_len);
                         goto fail_page;
                 }
+                if (!(tree->attributes & HFS_TREE_VARIDXKEYS)) {
+                        printk(KERN_ERR "hfs: invalid catalog btree flag\n");
+                        goto fail_page;
+                }
 
                 if (test_bit(HFSPLUS_SB_HFSX, &HFSPLUS_SB(sb)->flags) &&
                     (head->key_type == HFSPLUS_KEY_BINARY))
@@ -93,6 +102,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
                 goto fail_page;
         }
 
+        if (!(tree->attributes & HFS_TREE_BIGKEYS)) {
+                printk(KERN_ERR "hfs: invalid btree flag\n");
+                goto fail_page;
+        }
+
         size = tree->node_size;
         if (!is_power_of_2(size))
                 goto fail_page;