1 files changed, 41 insertions, 16 deletions

diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
index c88e5d72a402..2312de34bd42 100644
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -39,13 +39,17 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
            !(node->tree->attributes & HFS_TREE_VARIDXKEYS)) {
                 retval = node->tree->max_key_len + 2;
         } else {
-                recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
+                recoff = hfs_bnode_read_u16(node,
+                        node->tree->node_size - (rec + 1) * 2);
                 if (!recoff)
                         return 0;
-                if (node->tree->attributes & HFS_TREE_BIGKEYS)
-                        retval = hfs_bnode_read_u16(node, recoff) + 2;
-                else
-                        retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
+
+                retval = hfs_bnode_read_u16(node, recoff) + 2;
+                if (retval > node->tree->max_key_len + 2) {
+                        printk(KERN_ERR "hfs: keylen %d too large\n",
+                                retval);
+                        retval = 0;
+                }
         }
         return retval;
 }
@@ -81,7 +85,8 @@ again:
         end_rec_off = tree->node_size - (node->num_recs + 1) * 2;
         end_off = hfs_bnode_read_u16(node, end_rec_off);
         end_rec_off -= 2;
-        dprint(DBG_BNODE_MOD, "insert_rec: %d, %d, %d, %d\n", rec, size, end_off, end_rec_off);
+        dprint(DBG_BNODE_MOD, "insert_rec: %d, %d, %d, %d\n",
+                rec, size, end_off, end_rec_off);
         if (size > end_rec_off - end_off) {
                 if (new_node)
                         panic("not enough room!\n");
@@ -96,7 +101,9 @@ again:
         }
         node->num_recs++;
         /* write new last offset */
-        hfs_bnode_write_u16(node, offsetof(struct hfs_bnode_desc, num_recs), node->num_recs);
+        hfs_bnode_write_u16(node,
+                offsetof(struct hfs_bnode_desc, num_recs),
+                node->num_recs);
         hfs_bnode_write_u16(node, end_rec_off, end_off + size);
         data_off = end_off;
         data_rec_off = end_rec_off + 2;
@@ -148,7 +155,8 @@ skip:
                 if (tree->attributes & HFS_TREE_VARIDXKEYS)
                         key_len = be16_to_cpu(fd->search_key->key_len) + 2;
                 else {
-                        fd->search_key->key_len = cpu_to_be16(tree->max_key_len);
+                        fd->search_key->key_len =
+                                cpu_to_be16(tree->max_key_len);
                         key_len = tree->max_key_len + 2;
                 }
                 goto again;
@@ -177,7 +185,8 @@ again:
                 mark_inode_dirty(tree->inode);
         }
         hfs_bnode_dump(node);
-        dprint(DBG_BNODE_MOD, "remove_rec: %d, %d\n", fd->record, fd->keylength + fd->entrylength);
+        dprint(DBG_BNODE_MOD, "remove_rec: %d, %d\n",
+                fd->record, fd->keylength + fd->entrylength);
         if (!--node->num_recs) {
                 hfs_bnode_unlink(node);
                 if (!node->parent)
@@ -191,7 +200,9 @@ again:
                 __hfs_brec_find(node, fd);
                 goto again;
         }
-        hfs_bnode_write_u16(node, offsetof(struct hfs_bnode_desc, num_recs), node->num_recs);
+        hfs_bnode_write_u16(node,
+                offsetof(struct hfs_bnode_desc, num_recs),
+                node->num_recs);
 
         if (rec_off == end_off)
                 goto skip;
@@ -216,7 +227,7 @@ skip:
 static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
 {
         struct hfs_btree *tree;
-        struct hfs_bnode *node, *new_node;
+        struct hfs_bnode *node, *new_node, *next_node;
         struct hfs_bnode_desc node_desc;
         int num_recs, new_rec_off, new_off, old_rec_off;
         int data_start, data_end, size;
@@ -235,6 +246,17 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
         new_node->type = node->type;
         new_node->height = node->height;
 
+        if (node->next)
+                next_node = hfs_bnode_find(tree, node->next);
+        else
+                next_node = NULL;
+
+        if (IS_ERR(next_node)) {
+                hfs_bnode_put(node);
+                hfs_bnode_put(new_node);
+                return next_node;
+        }
+
         size = tree->node_size / 2 - node->num_recs * 2 - 14;
         old_rec_off = tree->node_size - 4;
         num_recs = 1;
@@ -248,6 +270,8 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
                 /* panic? */
                 hfs_bnode_put(node);
                 hfs_bnode_put(new_node);
+                if (next_node)
+                        hfs_bnode_put(next_node);
                 return ERR_PTR(-ENOSPC);
         }
 
@@ -302,8 +326,7 @@ static struct hfs_bnode *hfs_bnode_split(struct hfs_find_data *fd)
         hfs_bnode_write(node, &node_desc, 0, sizeof(node_desc));
 
         /* update next bnode header */
-        if (new_node->next) {
-                struct hfs_bnode *next_node = hfs_bnode_find(tree, new_node->next);
+        if (next_node) {
                 next_node->prev = new_node->this;
                 hfs_bnode_read(next_node, &node_desc, 0, sizeof(node_desc));
                 node_desc.prev = cpu_to_be32(next_node->prev);
@@ -349,7 +372,8 @@ again:
                 newkeylen = hfs_bnode_read_u16(node, 14) + 2;
         else
                 fd->keylength = newkeylen = tree->max_key_len + 2;
-        dprint(DBG_BNODE_MOD, "update_rec: %d, %d, %d\n", rec, fd->keylength, newkeylen);
+        dprint(DBG_BNODE_MOD, "update_rec: %d, %d, %d\n",
+                rec, fd->keylength, newkeylen);
 
         rec_off = tree->node_size - (rec + 2) * 2;
         end_rec_off = tree->node_size - (parent->num_recs + 1) * 2;
@@ -360,7 +384,7 @@ again:
                 end_off = hfs_bnode_read_u16(parent, end_rec_off);
                 if (end_rec_off - end_off < diff) {
 
-                        printk(KERN_DEBUG "hfs: splitting index node...\n");
+                        dprint(DBG_BNODE_MOD, "hfs: splitting index node.\n");
                         fd->bnode = parent;
                         new_node = hfs_bnode_split(fd);
                         if (IS_ERR(new_node))
@@ -368,7 +392,8 @@ again:
                         parent = fd->bnode;
                         rec = fd->record;
                         rec_off = tree->node_size - (rec + 2) * 2;
-                        end_rec_off = tree->node_size - (parent->num_recs + 1) * 2;
+                        end_rec_off = tree->node_size -
+                                (parent->num_recs + 1) * 2;
                 }
         }