hfsplus: validate btree flags (13571a69) · Commits · e / devices / android_kernel_xiaomi_nabu

fs/hfsplus/brec.c

+6 −14

Original line number	Diff line number	Diff line
		@@ -42,21 +42,13 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
		recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
		if (!recoff)
		return 0;
		if (node->tree->attributes & HFS_TREE_BIGKEYS) {

		retval = hfs_bnode_read_u16(node, recoff) + 2;
		if (retval > node->tree->max_key_len + 2) {
		printk(KERN_ERR "hfs: keylen %d too large\n",
		retval);
		retval = 0;
		}
		} else {
		retval = (hfs_bnode_read_u8(node, recoff) \| 1) + 1;
		if (retval > node->tree->max_key_len + 1) {
		printk(KERN_ERR "hfs: keylen %d too large\n",
		retval);
		retval = 0;
		}
		}
		}
		return retval;
		}

+14 −0

Original line number	Diff line number	Diff line
		@@ -71,6 +71,11 @@ struct hfs_btree hfs_btree_open(struct super_block sb, u32 id)
		tree->max_key_len);
		goto fail_page;
		}
		if (tree->attributes & HFS_TREE_VARIDXKEYS) {
		printk(KERN_ERR "hfs: invalid extent btree flag\n");
		goto fail_page;
		}

		tree->keycmp = hfsplus_ext_cmp_key;
		break;
		case HFSPLUS_CAT_CNID:
		@@ -79,6 +84,10 @@ struct hfs_btree hfs_btree_open(struct super_block sb, u32 id)
		tree->max_key_len);
		goto fail_page;
		}
		if (!(tree->attributes & HFS_TREE_VARIDXKEYS)) {
		printk(KERN_ERR "hfs: invalid catalog btree flag\n");
		goto fail_page;
		}

		if (test_bit(HFSPLUS_SB_HFSX, &HFSPLUS_SB(sb)->flags) &&
		(head->key_type == HFSPLUS_KEY_BINARY))
		@@ -93,6 +102,11 @@ struct hfs_btree hfs_btree_open(struct super_block sb, u32 id)
		goto fail_page;
		}

		if (!(tree->attributes & HFS_TREE_BIGKEYS)) {
		printk(KERN_ERR "hfs: invalid btree flag\n");
		goto fail_page;
		}

		size = tree->node_size;
		if (!is_power_of_2(size))
		goto fail_page;