hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c
kernel/fs/hfs/inode.c
....@@ -454,14 +454,16 @@
454454 /* panic? */
455455 return -EIO;
456456
457
+ res = -EIO;
458
+ if (HFS_I(main_inode)->cat_key.CName.len > HFS_NAMELEN)
459
+ goto out;
457460 fd.search_key->cat = HFS_I(main_inode)->cat_key;
458461 if (hfs_brec_find(&fd))
459
- /* panic? */
460462 goto out;
461463
462464 if (S_ISDIR(main_inode->i_mode)) {
463465 if (fd.entrylength < sizeof(struct hfs_cat_dir))
464
- /* panic? */;
466
+ goto out;
465467 hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
466468 sizeof(struct hfs_cat_dir));
467469 if (rec.type != HFS_CDR_DIR ||
....@@ -474,6 +476,8 @@
474476 hfs_bnode_write(fd.bnode, &rec, fd.entryoffset,
475477 sizeof(struct hfs_cat_dir));
476478 } else if (HFS_IS_RSRC(inode)) {
479
+ if (fd.entrylength < sizeof(struct hfs_cat_file))
480
+ goto out;
477481 hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
478482 sizeof(struct hfs_cat_file));
479483 hfs_inode_write_fork(inode, rec.file.RExtRec,
....@@ -482,7 +486,7 @@
482486 sizeof(struct hfs_cat_file));
483487 } else {
484488 if (fd.entrylength < sizeof(struct hfs_cat_file))
485
- /* panic? */;
489
+ goto out;
486490 hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
487491 sizeof(struct hfs_cat_file));
488492 if (rec.type != HFS_CDR_FIL ||
....@@ -499,9 +503,10 @@
499503 hfs_bnode_write(fd.bnode, &rec, fd.entryoffset,
500504 sizeof(struct hfs_cat_file));
501505 }
506
+ res = 0;
502507 out:
503508 hfs_find_exit(&fd);
504
- return 0;
509
+ return res;
505510 }
506511
507512 static struct dentry *hfs_file_lookup(struct inode *dir, struct dentry *dentry,