OSDN Git Service

hfsplus: fix Buffer overflow with a corrupted image
[linux-kernel-docs/linux-2.4.36.git] / fs / hfsplus / catalog.c
1 /*
2  *  linux/fs/hfsplus/catalog.c
3  *
4  * Copyright (C) 2001
5  * Brad Boyer (flar@allandria.com)
6  * (C) 2003 Ardis Technologies <roman@ardistech.com>
7  *
8  * Handling of catalog records
9  */
10
11 #include <linux/sched.h>
12
13 #include "hfsplus_fs.h"
14 #include "hfsplus_raw.h"
15
16 int hfsplus_cmp_cat_key(hfsplus_btree_key *k1, hfsplus_btree_key *k2)
17 {
18         u32 k1p, k2p;
19
20         k1p = k1->cat.parent;
21         k2p = k2->cat.parent;
22         if (k1p != k2p)
23                 return be32_to_cpu(k1p) < be32_to_cpu(k2p) ? -1 : 1;
24
25         return hfsplus_unistrcmp(&k1->cat.name, &k2->cat.name);
26 }
27
28 void hfsplus_fill_cat_key(hfsplus_btree_key *key, u32 parent,
29                           struct qstr *str)
30 {
31         int len;
32
33         key->cat.parent = cpu_to_be32(parent);
34         if (str) {
35                 hfsplus_asc2uni(&key->cat.name, str->name, str->len);
36                 len = be16_to_cpu(key->cat.name.length);
37         } else
38                 len = key->cat.name.length = 0;
39         key->key_len = cpu_to_be16(6 + 2 * len);
40 }
41
42 static void hfsplus_fill_cat_key_uni(hfsplus_btree_key *key, u32 parent,
43                                      hfsplus_unistr *name)
44 {
45         int ustrlen;
46
47         ustrlen = be16_to_cpu(name->length);
48         key->cat.parent = cpu_to_be32(parent);
49         key->cat.name.length = cpu_to_be16(ustrlen);
50         ustrlen *= 2;
51         memcpy(key->cat.name.unicode, name->unicode, ustrlen);
52         key->key_len = cpu_to_be16(6 + ustrlen);
53 }
54
55 static void hfsplus_set_perms(struct inode *inode, hfsplus_perm *perms)
56 {
57         perms->mode = cpu_to_be32(inode->i_mode);
58         perms->owner = cpu_to_be32(inode->i_uid);
59         perms->group = cpu_to_be32(inode->i_gid);
60 }
61
62 static int hfsplus_fill_cat_entry(hfsplus_cat_entry *entry, u32 cnid, struct inode *inode)
63 {
64         if (S_ISDIR(inode->i_mode)) {
65                 hfsplus_cat_folder *folder;
66
67                 folder = &entry->folder;
68                 memset(folder, 0, sizeof(*folder));
69                 folder->type = cpu_to_be16(HFSPLUS_FOLDER);
70                 folder->id = cpu_to_be32(inode->i_ino);
71                 folder->create_date = folder->content_mod_date = 
72                         folder->attribute_mod_date = folder->access_date = 
73                         hfsp_now2mt();
74                 hfsplus_set_perms(inode, &folder->permissions);
75                 if (inode == HFSPLUS_SB(inode->i_sb).hidden_dir)
76                         /* invisible and namelocked */
77                         folder->user_info.frFlags = cpu_to_be16(0x5000);
78                 return sizeof(*folder);
79         } else {
80                 hfsplus_cat_file *file;
81
82                 file = &entry->file;
83                 memset(file, 0, sizeof(*file));
84                 file->type = cpu_to_be16(HFSPLUS_FILE);
85                 file->id = cpu_to_be32(cnid);
86                 file->create_date = file->content_mod_date =
87                         file->attribute_mod_date = file->access_date =
88                         hfsp_now2mt();
89                 if (cnid == inode->i_ino) {
90                         hfsplus_set_perms(inode, &file->permissions);
91                         file->user_info.fdType = cpu_to_be32(HFSPLUS_SB(inode->i_sb).type);
92                         file->user_info.fdCreator = cpu_to_be32(HFSPLUS_SB(inode->i_sb).creator);
93                 } else {
94                         file->user_info.fdType = cpu_to_be32(HFSP_HARDLINK_TYPE);
95                         file->user_info.fdCreator = cpu_to_be32(HFSP_HFSPLUS_CREATOR);
96                         file->user_info.fdFlags = cpu_to_be16(0x100);
97                         file->permissions.dev = cpu_to_be32(HFSPLUS_I(inode).dev);
98                 }
99                 return sizeof(*file);
100         }
101 }
102
103 static int hfsplus_fill_cat_thread(hfsplus_cat_entry *entry, int type,
104                                    u32 parentid, struct qstr *str)
105 {
106         entry->type = cpu_to_be16(type);
107         entry->thread.reserved = 0;
108         entry->thread.parentID = cpu_to_be32(parentid);
109         hfsplus_asc2uni(&entry->thread.nodeName, str->name, str->len);
110         return 10 + be16_to_cpu(entry->thread.nodeName.length) * 2;
111 }
112
113 /* Try to get a catalog entry for given catalog id */
114 int hfsplus_find_cat(struct super_block *sb, unsigned long cnid,
115                      struct hfsplus_find_data *fd)
116 {
117         hfsplus_cat_entry tmp;
118         int err;
119         u16 type;
120
121         hfsplus_fill_cat_key(fd->search_key, cnid, NULL);
122         err = hfsplus_btree_find_entry(fd, &tmp, sizeof(hfsplus_cat_entry));
123         if (err)
124                 return err;
125
126         type = be16_to_cpu(tmp.type);
127         if (type != HFSPLUS_FOLDER_THREAD && type != HFSPLUS_FILE_THREAD) {
128                 printk("HFS+-fs: Found bad thread record in catalog\n");
129                 return -EIO;
130         }
131
132         if (be16_to_cpu(tmp.thread.nodeName.length) > 255) {
133                 printk(KERN_ERR "hfs: catalog name length corrupted\n");
134                 return -EIO;
135         }
136
137         hfsplus_fill_cat_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID),
138                                  &tmp.thread.nodeName);
139         return hfsplus_btree_find(fd);
140 }
141
142 int hfsplus_create_cat(u32 cnid, struct inode *dir, struct qstr *str, struct inode *inode)
143 {
144         struct hfsplus_find_data fd;
145         struct super_block *sb;
146         hfsplus_cat_entry entry;
147         int entry_size;
148         int err;
149
150         dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
151         sb = dir->i_sb;
152         hfsplus_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
153
154         hfsplus_fill_cat_key(fd.search_key, cnid, NULL);
155         entry_size = hfsplus_fill_cat_thread(&entry, S_ISDIR(inode->i_mode) ?
156                         HFSPLUS_FOLDER_THREAD : HFSPLUS_FILE_THREAD,
157                         dir->i_ino, str);
158         err = hfsplus_btree_find(&fd);
159         if (err != -ENOENT) {
160                 if (!err)
161                         err = -EEXIST;
162                 goto out;
163         }
164         err = hfsplus_bnode_insert_rec(&fd, &entry, entry_size);
165         if (err)
166                 goto out;
167
168         hfsplus_fill_cat_key(fd.search_key, dir->i_ino, str);
169         entry_size = hfsplus_fill_cat_entry(&entry, cnid, inode);
170         err = hfsplus_btree_find(&fd);
171         if (err != -ENOENT) {
172                 /* panic? */
173                 if (!err)
174                         err = -EEXIST;
175                 goto out;
176         }
177         err = hfsplus_bnode_insert_rec(&fd, &entry, entry_size);
178         if (!err) {
179                 dir->i_size++;
180                 mark_inode_dirty(dir);
181         }
182 out:
183         hfsplus_find_exit(&fd);
184
185         return err;
186 }
187
188 int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str)
189 {
190         struct super_block *sb;
191         struct hfsplus_find_data fd;
192         hfsplus_fork_raw fork;
193         struct list_head *pos;
194         int err, off;
195         u16 type;
196
197         dprint(DBG_CAT_MOD, "delete_cat: %s,%u\n", str ? str->name : NULL, cnid);
198         sb = dir->i_sb;
199         hfsplus_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
200
201         if (!str) {
202                 int len;
203
204                 hfsplus_fill_cat_key(fd.search_key, cnid, NULL);
205                 err = hfsplus_btree_find(&fd);
206                 if (err)
207                         goto out;
208
209                 off = fd.entryoffset + offsetof(hfsplus_cat_thread, nodeName);
210                 fd.search_key->cat.parent = cpu_to_be32(dir->i_ino);
211                 hfsplus_bnode_readbytes(fd.bnode, &fd.search_key->cat.name.length, off, 2);
212                 len = be16_to_cpu(fd.search_key->cat.name.length) * 2;
213                 hfsplus_bnode_readbytes(fd.bnode, &fd.search_key->cat.name.unicode, off + 2, len);
214                 fd.search_key->key_len = cpu_to_be16(6 + len);
215         } else
216                 hfsplus_fill_cat_key(fd.search_key, dir->i_ino, str);
217
218         err = hfsplus_btree_find(&fd);
219         if (err)
220                 goto out;
221
222         type = hfsplus_bnode_read_u16(fd.bnode, fd.entryoffset);
223         if (type == HFSPLUS_FILE) {
224 #if 0
225                 off = fd.entryoffset + offsetof(hfsplus_cat_file, data_fork);
226                 hfsplus_bnode_readbytes(fd.bnode, &fork, off, sizeof(fork));
227                 hfsplus_free_fork(sb, cnid, &fork, HFSPLUS_TYPE_DATA);
228 #endif
229
230                 off = fd.entryoffset + offsetof(hfsplus_cat_file, rsrc_fork);
231                 hfsplus_bnode_readbytes(fd.bnode, &fork, off, sizeof(fork));
232                 hfsplus_free_fork(sb, cnid, &fork, HFSPLUS_TYPE_RSRC);
233         }
234
235         list_for_each(pos, &HFSPLUS_I(dir).open_dir_list) {
236                 struct hfsplus_readdir_data *rd =
237                         list_entry(pos, struct hfsplus_readdir_data, list);
238                 if (fd.tree->keycmp(fd.search_key, (void *)&rd->key) < 0)
239                         rd->file->f_pos--;
240         }
241
242         err = hfsplus_bnode_remove_rec(&fd);
243         if (err)
244                 goto out;
245
246         hfsplus_fill_cat_key(fd.search_key, cnid, NULL);
247         err = hfsplus_btree_find(&fd);
248         if (err)
249                 goto out;
250
251         err = hfsplus_bnode_remove_rec(&fd);
252         if (err) 
253                 goto out;
254
255         dir->i_size--;
256         mark_inode_dirty(dir);
257 out:
258         hfsplus_find_exit(&fd);
259
260         return err;
261 }
262
263 int hfsplus_rename_cat(u32 cnid,
264                        struct inode *src_dir, struct qstr *src_name,
265                        struct inode *dst_dir, struct qstr *dst_name)
266 {
267         struct super_block *sb;
268         struct hfsplus_find_data src_fd, dst_fd;
269         hfsplus_cat_entry entry;
270         int entry_size, type;
271         int err = 0;
272
273         dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
274                 dst_dir->i_ino, dst_name->name);
275         sb = src_dir->i_sb;
276         hfsplus_find_init(HFSPLUS_SB(sb).cat_tree, &src_fd);
277         dst_fd = src_fd;
278
279         /* find the old dir entry and read the data */
280         hfsplus_fill_cat_key(src_fd.search_key, src_dir->i_ino, src_name);
281         err = hfsplus_btree_find(&src_fd);
282         if (err)
283                 goto out;
284                 
285         hfsplus_bnode_readbytes(src_fd.bnode, &entry, src_fd.entryoffset,
286                                 src_fd.entrylength);
287
288         /* create new dir entry with the data from the old entry */
289         hfsplus_fill_cat_key(dst_fd.search_key, dst_dir->i_ino, dst_name);
290         err = hfsplus_btree_find(&dst_fd);
291         if (err != -ENOENT) {
292                 if (!err)
293                         err = -EEXIST;
294                 goto out;
295         }
296
297         err = hfsplus_bnode_insert_rec(&dst_fd, &entry, src_fd.entrylength);
298         if (err)
299                 goto out;
300         dst_dir->i_size++;
301         mark_inode_dirty(dst_dir);
302
303         /* finally remove the old entry */
304         hfsplus_fill_cat_key(src_fd.search_key, src_dir->i_ino, src_name);
305         err = hfsplus_btree_find(&src_fd);
306         if (err)
307                 goto out;
308         err = hfsplus_bnode_remove_rec(&src_fd);
309         if (err)
310                 goto out;
311         src_dir->i_size--;
312         mark_inode_dirty(src_dir);
313
314         /* remove old thread entry */
315         hfsplus_fill_cat_key(src_fd.search_key, cnid, NULL);
316         err = hfsplus_btree_find(&src_fd);
317         if (err)
318                 goto out;
319         type = hfsplus_bnode_read_u16(src_fd.bnode, src_fd.entryoffset);
320         err = hfsplus_bnode_remove_rec(&src_fd);
321         if (err)
322                 goto out;
323
324         /* create new thread entry */
325         hfsplus_fill_cat_key(dst_fd.search_key, cnid, NULL);
326         entry_size = hfsplus_fill_cat_thread(&entry, type, dst_dir->i_ino, dst_name);
327         err = hfsplus_btree_find(&dst_fd);
328         if (err != -ENOENT) {
329                 if (!err)
330                         err = -EEXIST;
331                 goto out;
332         }
333         err = hfsplus_bnode_insert_rec(&dst_fd, &entry, entry_size);
334 out:
335         hfsplus_put_bnode(dst_fd.bnode);
336         hfsplus_find_exit(&src_fd);
337         return err;
338 }