2.6.24

 fs

 hfs

diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c
index f13f149..f8452a0 100644
--- a/fs/hfs/bfind.c
+++ b/fs/hfs/bfind.c
@@ -52,6 +52,10 @@ int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd)
       rec = (e + b) / 2;
       len = hfs_brec_lenoff(bnode, rec, &off);
       keylen = hfs_brec_keylen(bnode, rec);
+      if (keylen == HFS_BAD_KEYLEN) {
+         res = -EINVAL;
+         goto done;
+      }
       hfs_bnode_read(bnode, fd->key, off, keylen);
       cmpval = bnode->tree->keycmp(fd->key, fd->search_key);
       if (!cmpval) {
@@ -67,6 +71,10 @@ int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd)
    if (rec != e && e >= 0) {
       len = hfs_brec_lenoff(bnode, e, &off);
       keylen = hfs_brec_keylen(bnode, e);
+      if (keylen == HFS_BAD_KEYLEN) {
+         res = -EINVAL;
+         goto done;
+      }
       hfs_bnode_read(bnode, fd->key, off, keylen);
    }
 done:
@@ -198,6 +206,10 @@ int hfs_brec_goto(struct hfs_find_data *fd, int cnt)
 
    len = hfs_brec_lenoff(bnode, fd->record, &off);
    keylen = hfs_brec_keylen(bnode, fd->record);
+   if (keylen == HFS_BAD_KEYLEN) {
+      res = -EINVAL;
+      goto out;
+   }
    fd->keyoffset = off;
    fd->keylength = keylen;
    fd->entryoffset = off + keylen;