hfs: fix a potential buffer overflow

[karo-tx-linux.git] / fs / hfs / super.c

diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index f7fcbe49da723c40b56c816c8f04bea6e8d24616..5ed7252b7b23246aabdb015341ba19cbb101379a 100644 (file)
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -409,8 +409,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
        /* try to get the root inode */
        hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
        res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
-       if (!res)
+       if (!res) {
+               if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
+                       res =  -EIO;
+                       goto bail;
+               }
                hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
+       }
        if (res) {
                hfs_find_exit(&fd);
                goto bail_no_root;