[PATCH] hfs: validate drAlBlkSiz and fs_ablocks in hfs_mdb_get()

[PATCH] hfs: validate drAlBlkSiz and fs_ablocks in hfs_mdb_get()

[Hui Peng]

In hfs_mdb_get() (fs/hfs/mdb.c), reject images with allocation block
size (drAlBlkSiz) of 0 or not a multiple of HFS_SECTOR_SIZE (512), or
with fs_ablocks == 0, preventing a divide-by-zero trap and out-of-bounds
bitmap scans on crafted HFS images.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 277de712f9d4..9e78c561a3f1 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -204,6 +204,11 @@ int hfs_mdb_get(struct super_block *sb)
 	/* These parameters are read from the MDB, and never written */
 	HFS_SB(sb)->part_start = part_start;
 	HFS_SB(sb)->fs_ablocks = be16_to_cpu(mdb->drNmAlBlks);
+	if (!HFS_SB(sb)->fs_ablocks) {
+		brelse(bh);
+		HFS_SB(sb)->mdb_bh = NULL;
+		return -EINVAL;
+	}
 	HFS_SB(sb)->fs_div = HFS_SB(sb)->alloc_blksz >> sb->s_blocksize_bits;
 	HFS_SB(sb)->clumpablks = be32_to_cpu(mdb->drClpSiz) /
 				 HFS_SB(sb)->alloc_blksz;