2.6.24

 fs

 hfs

diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 8a3a650..110dd35 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -61,7 +61,7 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
    mapping = tree->inode->i_mapping;
    page = read_mapping_page(mapping, 0, NULL);
    if (IS_ERR(page))
-      goto free_tree;
+      goto free_inode;
 
    /* Load the header */
    head = (struct hfs_btree_header_rec *)(kmap(page) + sizeof(struct hfs_bnode_desc));
@@ -81,6 +81,17 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
       goto fail_page;
    if (!tree->node_count)
       goto fail_page;
+   if ((id == HFS_EXT_CNID) && (tree->max_key_len != HFS_MAX_EXT_KEYLEN)) {
+      printk(KERN_ERR "hfs: invalid extent max_key_len %d\n",
+         tree->max_key_len);
+      goto fail_page;
+   }
+   if ((id == HFS_CAT_CNID) && (tree->max_key_len != HFS_MAX_CAT_KEYLEN)) {
+      printk(KERN_ERR "hfs: invalid catalog max_key_len %d\n",
+         tree->max_key_len);
+      goto fail_page;
+   }
+
    tree->node_size_shift = ffs(size) - 1;
    tree->pages_per_bnode = (tree->node_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
@@ -88,11 +99,12 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
    page_cache_release(page);
    return tree;
 
- fail_page:
-   tree->inode->i_mapping->a_ops = &hfs_aops;
+fail_page:
    page_cache_release(page);
- free_tree:
+free_inode:
+   tree->inode->i_mapping->a_ops = &hfs_aops;
    iput(tree->inode);
+free_tree:
    kfree(tree);
    return NULL;
 }