1 files changed, 16 insertions, 4 deletions

diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 8a3a650abc87..110dd3515dc8 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -61,7 +61,7 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
-                goto free_tree;
+                goto free_inode;
 
         /* Load the header */
         head = (struct hfs_btree_header_rec *)(kmap(page) + sizeof(struct hfs_bnode_desc));
@@ -81,6 +81,17 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
                 goto fail_page;
         if (!tree->node_count)
                 goto fail_page;
+        if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
+                printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+                        tree->max_key_len);
+                goto fail_page;
+        }
+        if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
+                printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+                        tree->max_key_len);
+                goto fail_page;
+        }
+
         tree->node_size_shift = ffs(size) - 1;
         tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
@@ -88,11 +99,12 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         page_cache_release(page);
         return tree;
 
- fail_page:
-        tree->inode->i_mapping->a_ops = &hfs_aops;
+fail_page:
         page_cache_release(page);
- free_tree:
+free_inode:
+        tree->inode->i_mapping->a_ops = &hfs_aops;
         iput(tree->inode);
+free_tree:
         kfree(tree);
         return NULL;
 }