diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c index 53f3fae60217..c536ab8b18d7 100644 --- a/fs/hfs/mdb.c +++ b/fs/hfs/mdb.c @@ -156,6 +156,21 @@ int hfs_mdb_get(struct super_block *sb) atomic64_set(&HFS_SB(sb)->file_count, be32_to_cpu(mdb->drFilCnt)); atomic64_set(&HFS_SB(sb)->folder_count, be32_to_cpu(mdb->drDirCnt)); + if (atomic64_read(&HFS_SB(sb)->next_id) > U32_MAX) { + pr_warn("next cnid is corrupted\n"); + goto out; + } + + if (atomic64_read(&HFS_SB(sb)->file_count) > U32_MAX) { + pr_warn("file count is corrupted\n"); + goto out; + } + + if (atomic64_read(&HFS_SB(sb)->folder_count) > U32_MAX) { + pr_warn("folder count is corrupted\n"); + goto out; + } + /* TRY to get the alternate (backup) MDB. */ sect = part_start + part_size - 2; bh = sb_bread512(sb, sect, mdb2);