hfsplus: validate btree flags

Signed-off-by: Christoph Hellwig <hch@tuxera.com>

fs/hfsplus/brec.c

@@ -42,20 +42,12 @@ u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec)
 		recoff = hfs_bnode_read_u16(node, node->tree->node_size - (rec + 1) * 2);
 		if (!recoff)
 			return 0;
-		if (node->tree->attributes & HFS_TREE_BIGKEYS) {
-			retval = hfs_bnode_read_u16(node, recoff) + 2;
-			if (retval > node->tree->max_key_len + 2) {
-				printk(KERN_ERR "hfs: keylen %d too large\n",
-					retval);
-				retval = 0;
-			}
-		} else {
-			retval = (hfs_bnode_read_u8(node, recoff) | 1) + 1;
-			if (retval > node->tree->max_key_len + 1) {
-				printk(KERN_ERR "hfs: keylen %d too large\n",
-					retval);
-				retval = 0;
-			}
+
+		retval = hfs_bnode_read_u16(node, recoff) + 2;
+		if (retval > node->tree->max_key_len + 2) {
+			printk(KERN_ERR "hfs: keylen %d too large\n",
+				retval);
+			retval = 0;
 		}
 	}
 	return retval;

fs/hfsplus/btree.c

@@ -71,6 +71,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
 				tree->max_key_len);
 			goto fail_page;
 		}
+		if (tree->attributes & HFS_TREE_VARIDXKEYS) {
+			printk(KERN_ERR "hfs: invalid extent btree flag\n");
+			goto fail_page;
+		}
+
 		tree->keycmp = hfsplus_ext_cmp_key;
 		break;
 	case HFSPLUS_CAT_CNID:
@@ -79,6 +84,10 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
 				tree->max_key_len);
 			goto fail_page;
 		}
+		if (!(tree->attributes & HFS_TREE_VARIDXKEYS)) {
+			printk(KERN_ERR "hfs: invalid catalog btree flag\n");
+			goto fail_page;
+		}
 
 		if (test_bit(HFSPLUS_SB_HFSX, &HFSPLUS_SB(sb)->flags) &&
 		    (head->key_type == HFSPLUS_KEY_BINARY))
@@ -93,6 +102,11 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id)
 		goto fail_page;
 	}
 
+	if (!(tree->attributes & HFS_TREE_BIGKEYS)) {
+		printk(KERN_ERR "hfs: invalid btree flag\n");
+		goto fail_page;
+	}
+
 	size = tree->node_size;
 	if (!is_power_of_2(size))
 		goto fail_page;