The classic HFS variant of the same bug: hfs_bnode_read_key() accepts
an on-disk key length up to sizeof(hfs_btree_key), while the key buffers
from hfs_find_init() hold tree->max_key_len + 2 bytes (18 bytes in total
for the extents tree). Bound the length by the tree's maximum and clear
only the buffer's own size on error.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: bb5e07cb9277 ("hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key")
Reported-by: Guikun Yang <yangguikun19@qq.com>
Closes: https://lore.kernel.org/all/tencent_F85118A9AFDF9B230D4E8FA672510A3E2F08@qq.com/
Cc: stable@vger.kernel.org
Signed-off-by: ozgun kultekin <ozgunkultekin@gmail.com>
---
diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
index fcb5b9c..f678eed 100644
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -83,8 +83,9 @@ void hfs_bnode_read_key(struct hfs_bnode *node, void *key, u32 off)
 	else
 		key_len = tree->max_key_len + 1;
 
-	if (key_len > sizeof(hfs_btree_key) || key_len < 1) {
-		memset(key, 0, sizeof(hfs_btree_key));
+	/* hfs_find_init() sizes each key buffer as tree->max_key_len + 2 */
+	if (key_len > tree->max_key_len + 1 || key_len < 1) {
+		memset(key, 0, tree->max_key_len + 2);
 		pr_err("hfs: Invalid key length: %u\n", key_len);
 		return;
 	}
--
2.47.0