livefiles_hfs_plugin/lf_hfs_endian.c

   1 //
   2 //  lf_hfs_endian.c
   3 //  livefiles_hfs
   4 //
   5 //  Created by Yakov Ben Zaken on 22/03/2018.
   6 //
   7
   8 #include <stdio.h>
   9
  10
  11 #include "lf_hfs_endian.h"
  12 #include "lf_hfs_btrees_private.h"
  13 #include "lf_hfs_vfsops.h"
  14 #include "lf_hfs_utils.h"
  15 #include "lf_hfs_generic_buf.h"
  16
  17 #define DEBUG_BTNODE_SWAP 0
  18
  19 /*
  20  * Internal swapping routines
  21  *
  22  * These routines handle swapping the records of leaf and index nodes.  The
  23  * layout of the keys and records varies depending on the kind of B-tree
  24  * (determined by fileID).
  25  *
  26  * The direction parameter must be kSwapBTNodeBigToHost or kSwapBTNodeHostToBig.
  27  * The kSwapBTNodeHeaderRecordOnly "direction" is not valid for these routines.
  28  */
  29 int hfs_swap_HFSPlusBTInternalNode (BlockDescriptor *src, HFSCatalogNodeID fileID, enum HFSBTSwapDirection direction);
  30 void hfs_swap_HFSPlusForkData (HFSPlusForkData *src);
  31
  32 /*
  33  * hfs_swap_HFSPlusForkData
  34  */
  35 void
  36 hfs_swap_HFSPlusForkData (
  37                           HFSPlusForkData *src
  38                           )
  39 {
  40     int i;
  41
  42     src->logicalSize        = SWAP_BE64 (src->logicalSize);
  43
  44     src->clumpSize            = SWAP_BE32 (src->clumpSize);
  45     src->totalBlocks        = SWAP_BE32 (src->totalBlocks);
  46
  47     for (i = 0; i < kHFSPlusExtentDensity; i++) {
  48         src->extents[i].startBlock    = SWAP_BE32 (src->extents[i].startBlock);
  49         src->extents[i].blockCount    = SWAP_BE32 (src->extents[i].blockCount);
  50     }
  51 }
  52
  53 /*
  54  * hfs_swap_BTNode
  55  *
  56  *  NOTE: This operation is not naturally symmetric.
  57  *        We have to determine which way we're swapping things.
  58  */
  59 int
  60 hfs_swap_BTNode (
  61                  BlockDescriptor *src,
  62                  vnode_t vp,
  63                  enum HFSBTSwapDirection direction,
  64                  u_int8_t allow_empty_node
  65                  )
  66 {
  67
  68     GenericLFBuf *psBuf = src->blockHeader;
  69     lf_hfs_generic_buf_lock(psBuf);
  70
  71     switch(direction) {
  72         case kSwapBTNodeBigToHost:
  73             lf_hfs_generic_buf_set_cache_flag(psBuf, GEN_BUF_LITTLE_ENDIAN);
  74             break;
  75         case kSwapBTNodeHostToBig:
  76             lf_hfs_generic_buf_clear_cache_flag(psBuf, GEN_BUF_LITTLE_ENDIAN);
  77             break;
  78         case kSwapBTNodeHeaderRecordOnly:
  79             break;
  80         default:
  81             panic("invalid direction");
  82     }
  83
  84
  85     BTNodeDescriptor *srcDesc = src->buffer;
  86     u_int16_t *srcOffs = NULL;
  87     BTreeControlBlockPtr btcb = (BTreeControlBlockPtr)VTOF(vp)->fcbBTCBPtr;
  88     u_int16_t i; /* index to match srcDesc->numRecords */
  89     int error = 0;
  90
  91     #if DEBUG_BTNODE_SWAP
  92         printf("hfs_swap_BTNode: direction %u (%s), psVnode %p, blockNum %llu uPhyCluster %llu\n", direction, (direction==0)?"RD":(direction==1)?"WR":"NA", vp, src->blockNum, psBuf->uPhyCluster);
  93         uint32_t *pData = src->buffer;
  94         printf("hfs_swap_BTNode: %p before: 0x%x, 0x%x, 0x%x, 0x%x\n", pData, pData[0], pData[1], pData[2], pData[3]);
  95     #endif
  96
  97 #ifdef ENDIAN_DEBUG
  98     if (direction == kSwapBTNodeBigToHost) {
  99         LFHFS_LOG(LEVEL_DEBUG, "hfs: BE -> Native Swap\n");
 100     } else if (direction == kSwapBTNodeHostToBig) {
 101         LFHFS_LOG(LEVEL_DEBUG, "hfs: Native -> BE Swap\n");
 102     } else if (direction == kSwapBTNodeHeaderRecordOnly) {
 103         LFHFS_LOG(LEVEL_DEBUG, "hfs: Not swapping descriptors\n");
 104     } else {
 105         LFHFS_LOG(LEVEL_ERROR, "hfs_swap_BTNode: This is impossible");
 106         hfs_assert(0);
 107     }
 108 #endif
 109
 110     /*
 111      * If we are doing a swap from on-disk to in-memory, then swap the node
 112      * descriptor and record offsets before we need to use them.
 113      */
 114     if (direction == kSwapBTNodeBigToHost) {
 115         srcDesc->fLink        = SWAP_BE32 (srcDesc->fLink);
 116         srcDesc->bLink        = SWAP_BE32 (srcDesc->bLink);
 117
 118         /*
 119          * When first opening a BTree, we have to read the header node before the
 120          * control block is initialized.  In this case, totalNodes will be zero,
 121          * so skip the bounds checking. Also, we should ignore the header node when
 122          * checking for invalid forwards and backwards links, since the header node's
 123          * links can point back to itself legitimately.
 124          */
 125         if (btcb->totalNodes != 0) {
 126             if (srcDesc->fLink >= btcb->totalNodes) {
 127                 LFHFS_LOG( LEVEL_ERROR, "hfs_swap_BTNode: invalid forward link (0x%08x >= 0x%08x)\n", srcDesc->fLink, btcb->totalNodes);
 128                 error = fsBTInvalidHeaderErr;
 129                 goto fail;
 130             }
 131             if (srcDesc->bLink >= btcb->totalNodes) {
 132                 LFHFS_LOG( LEVEL_ERROR, "hfs_swap_BTNode: invalid backward link (0x%08x >= 0x%08x)\n", srcDesc->bLink, btcb->totalNodes);
 133                 error = fsBTInvalidHeaderErr;
 134                 goto fail;
 135             }
 136
 137             if ((src->blockNum != 0) && (srcDesc->fLink == (u_int32_t) src->blockNum)) {
 138                 LFHFS_LOG( LEVEL_ERROR, "hfs_swap_BTNode: invalid forward link (0x%08x == 0x%08x)\n", srcDesc->fLink, (u_int32_t) src->blockNum);
 139                 error = fsBTInvalidHeaderErr;
 140                 goto fail;
 141             }
 142             if ((src->blockNum != 0) && (srcDesc->bLink == (u_int32_t) src->blockNum)) {
 143                 LFHFS_LOG( LEVEL_ERROR, "hfs_swap_BTNode: invalid backward link (0x%08x == 0x%08x)\n", srcDesc->bLink, (u_int32_t) src->blockNum);
 144                 error = fsBTInvalidHeaderErr;
 145                 goto fail;
 146             }
 147
 148
 149         }
 150
 151         /*
 152          * Check srcDesc->kind.  Don't swap it because it's only one byte.
 153          */
 154         if (srcDesc->kind < kBTLeafNode || srcDesc->kind > kBTMapNode) {
 155             LFHFS_LOG(LEVEL_ERROR , "hfs_swap_BTNode: invalid node kind (%d)\n", srcDesc->kind);
 156             error = fsBTInvalidHeaderErr;
 157             goto fail;
 158         }
 159
 160         /*
 161          * Check srcDesc->height.  Don't swap it because it's only one byte.
 162          */
 163         if (srcDesc->height > kMaxTreeDepth) {
 164             LFHFS_LOG(LEVEL_ERROR , "hfs_swap_BTNode: invalid node height (%d)\n", srcDesc->height);
 165             error = fsBTInvalidHeaderErr;
 166             goto fail;
 167         }
 168
 169         /* Don't swap srcDesc->reserved */
 170
 171         srcDesc->numRecords    = SWAP_BE16 (srcDesc->numRecords);
 172
 173         /*
 174          * Swap the node offsets (including the free space one!).
 175          */
 176         srcOffs = (u_int16_t *)((char *)src->buffer + (src->blockSize - ((srcDesc->numRecords + 1) * sizeof (u_int16_t))));
 177
 178         /*
 179          * Sanity check that the record offsets are within the node itself.
 180          */
 181         if ((char *)srcOffs > ((char *)src->buffer + src->blockSize) ||
 182             (char *)srcOffs < ((char *)src->buffer + sizeof(BTNodeDescriptor))) {
 183             LFHFS_LOG(LEVEL_ERROR , "hfs_swap_BTNode: invalid record count (0x%04X)\n", srcDesc->numRecords);
 184             error = fsBTInvalidHeaderErr;
 185             goto fail;
 186         }
 187
 188         /*
 189          * Swap and sanity check each of the record offsets.
 190          */
 191         for (i = 0; i <= srcDesc->numRecords; i++) {
 192             srcOffs[i]    = SWAP_BE16 (srcOffs[i]);
 193
 194             /*
 195              * Sanity check: must be even, and within the node itself.
 196              *
 197              * We may be called to swap an unused node, which contains all zeroes.
 198              * Unused nodes are expected only when allow_empty_node is true.
 199              * If it is false and record offset is zero, return error.
 200              */
 201             if ((srcOffs[i] & 1) || (
 202                                      (allow_empty_node == false) && (srcOffs[i] == 0)) ||
 203                 (srcOffs[i] < sizeof(BTNodeDescriptor) && srcOffs[i] != 0) ||
 204                 (srcOffs[i] > (src->blockSize - 2 * (srcDesc->numRecords + 1)))) {
 205                 LFHFS_LOG(LEVEL_ERROR , "hfs_swap_BTNode: offset #%d invalid (0x%04X) (blockSize 0x%x numRecords %d)\n",
 206                           i, srcOffs[i], (int32_t)src->blockSize, srcDesc->numRecords);
 207                 error = fsBTInvalidHeaderErr;
 208                 goto fail;
 209             }
 210
 211             /*
 212              * Make sure the offsets are strictly increasing.  Note that we're looping over
 213              * them backwards, hence the order in the comparison.
 214              */
 215             if ((i != 0) && (srcOffs[i] >= srcOffs[i-1])) {
 216                 LFHFS_LOG(LEVEL_ERROR , "hfs_swap_BTNode: offsets %d and %d out of order (0x%04X, 0x%04X)\n",
 217                           i, i-1, srcOffs[i], srcOffs[i-1]);
 218
 219                 error = fsBTInvalidHeaderErr;
 220                 goto fail;
 221             }
 222         }
 223     }
 224
 225     /*
 226      * Swap the records (ordered by frequency of access)
 227      */
 228     if ((srcDesc->kind == kBTIndexNode) ||
 229         (srcDesc->kind == kBTLeafNode)) {
 230
 231         error = hfs_swap_HFSPlusBTInternalNode (src, VTOC(vp)->c_fileid, direction);
 232         if (error) goto fail;
 233
 234     } else if (srcDesc-> kind == kBTMapNode) {
 235         /* Don't swap the bitmaps, they'll be done in the bitmap routines */
 236
 237     } else if (srcDesc-> kind == kBTHeaderNode) {
 238         /* The header's offset is hard-wired because we cannot trust the offset pointers. */
 239         BTHeaderRec *srcHead = (BTHeaderRec *)((char *)src->buffer + sizeof(BTNodeDescriptor));
 240
 241         srcHead->treeDepth        =    SWAP_BE16 (srcHead->treeDepth);
 242
 243         srcHead->rootNode        =    SWAP_BE32 (srcHead->rootNode);
 244         srcHead->leafRecords    =    SWAP_BE32 (srcHead->leafRecords);
 245         srcHead->firstLeafNode    =    SWAP_BE32 (srcHead->firstLeafNode);
 246         srcHead->lastLeafNode    =    SWAP_BE32 (srcHead->lastLeafNode);
 247
 248         srcHead->nodeSize        =    SWAP_BE16 (srcHead->nodeSize);
 249         srcHead->maxKeyLength    =    SWAP_BE16 (srcHead->maxKeyLength);
 250
 251         srcHead->totalNodes        =    SWAP_BE32 (srcHead->totalNodes);
 252         srcHead->freeNodes        =    SWAP_BE32 (srcHead->freeNodes);
 253
 254         srcHead->clumpSize        =    SWAP_BE32 (srcHead->clumpSize);
 255         srcHead->attributes        =    SWAP_BE32 (srcHead->attributes);
 256
 257         /* Don't swap srcHead->reserved1 */
 258         /* Don't swap srcHead->btreeType; it's only one byte */
 259         /* Don't swap srcHead->reserved2 */
 260         /* Don't swap srcHead->reserved3 */
 261         /* Don't swap bitmap */
 262     }
 263
 264     /*
 265      * If we are doing a swap from in-memory to on-disk, then swap the node
 266      * descriptor and record offsets after we're done using them.
 267      */
 268     if (direction == kSwapBTNodeHostToBig) {
 269         /*
 270          * Sanity check and swap the forward and backward links.
 271          * Ignore the header node since its forward and backwards links can legitimately
 272          * point to itself.
 273          */
 274         if (srcDesc->fLink >= btcb->totalNodes) {
 275             LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: invalid forward link (0x%08X)\n", srcDesc->fLink);
 276             error = fsBTInvalidHeaderErr;
 277             goto fail;
 278         }
 279         if ((src->blockNum != 0) && (srcDesc->fLink == (u_int32_t) src->blockNum)) {
 280             LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: invalid forward link (0x%08x == 0x%08x)\n",
 281                       srcDesc->fLink, (u_int32_t) src->blockNum);
 282             error = fsBTInvalidHeaderErr;
 283             goto fail;
 284         }
 285
 286         if (srcDesc->bLink >= btcb->totalNodes) {
 287             LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: invalid backward link (0x%08X)\n", srcDesc->bLink);
 288             error = fsBTInvalidHeaderErr;
 289             goto fail;
 290         }
 291         if ((src->blockNum != 0) && (srcDesc->bLink == (u_int32_t) src->blockNum)) {
 292             LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: invalid backward link (0x%08x == 0x%08x)\n",
 293                       srcDesc->bLink, (u_int32_t) src->blockNum);
 294             error = fsBTInvalidHeaderErr;
 295             goto fail;
 296         }
 297
 298
 299         srcDesc->fLink        = SWAP_BE32 (srcDesc->fLink);
 300         srcDesc->bLink        = SWAP_BE32 (srcDesc->bLink);
 301
 302         /*
 303          * Check srcDesc->kind.  Don't swap it because it's only one byte.
 304          */
 305         if (srcDesc->kind < kBTLeafNode || srcDesc->kind > kBTMapNode) {
 306             LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: invalid node kind (%d)\n", srcDesc->kind);
 307             error = fsBTInvalidHeaderErr;
 308             goto fail;
 309         }
 310
 311         /*
 312          * Check srcDesc->height.  Don't swap it because it's only one byte.
 313          */
 314         if (srcDesc->height > kMaxTreeDepth) {
 315             LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: invalid node height (%d)\n", srcDesc->height);
 316             error = fsBTInvalidHeaderErr;
 317             goto fail;
 318         }
 319
 320         /* Don't swap srcDesc->reserved */
 321
 322         /*
 323          * Swap the node offsets (including the free space one!).
 324          */
 325         srcOffs = (u_int16_t *)((char *)src->buffer + (src->blockSize - ((srcDesc->numRecords + 1) * sizeof (u_int16_t))));
 326
 327         /*
 328          * Sanity check that the record offsets are within the node itself.
 329          */
 330         if ((char *)srcOffs > ((char *)src->buffer + src->blockSize) ||
 331             (char *)srcOffs < ((char *)src->buffer + sizeof(BTNodeDescriptor))) {
 332             LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: invalid record count (0x%04X)\n", srcDesc->numRecords);
 333             error = fsBTInvalidHeaderErr;
 334             goto fail;
 335         }
 336
 337         /*
 338          * Swap and sanity check each of the record offsets.
 339          */
 340         for (i = 0; i <= srcDesc->numRecords; i++) {
 341             /*
 342              * Sanity check: must be even, and within the node itself.
 343              *
 344              * We may be called to swap an unused node, which contains all zeroes.
 345              * This can happen when the last record from a node gets deleted.
 346              * This is why we allow the record offset to be zero.
 347              * Unused nodes are expected only when allow_empty_node is true
 348              * (the caller should set it to true for kSwapBTNodeBigToHost).
 349              */
 350             if ((srcOffs[i] & 1) ||
 351                 ((allow_empty_node == false) && (srcOffs[i] == 0)) ||
 352                 (srcOffs[i] < sizeof(BTNodeDescriptor) && srcOffs[i] != 0) ||
 353                 (srcOffs[i] > (src->blockSize - 2 * (srcDesc->numRecords + 1)))) {
 354                 LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: offset #%d invalid (0x%04X) (blockSize 0x%lx numRecords %d)\n",
 355                           i, srcOffs[i], src->blockSize, srcDesc->numRecords);
 356                 error = fsBTInvalidHeaderErr;
 357                 goto fail;
 358             }
 359
 360             /*
 361              * Make sure the offsets are strictly increasing.  Note that we're looping over
 362              * them backwards, hence the order in the comparison.
 363              */
 364             if ((i < srcDesc->numRecords) && (srcOffs[i+1] >= srcOffs[i])) {
 365                 LFHFS_LOG(LEVEL_ERROR, "hfs_UNswap_BTNode: offsets %d and %d out of order (0x%04X, 0x%04X)\n",
 366                           i+1, i, srcOffs[i+1], srcOffs[i]);
 367                 error = fsBTInvalidHeaderErr;
 368                 goto fail;
 369             }
 370
 371             srcOffs[i]    = SWAP_BE16 (srcOffs[i]);
 372         }
 373
 374         srcDesc->numRecords    = SWAP_BE16 (srcDesc->numRecords);
 375     }
 376
 377 fail:
 378     lf_hfs_generic_buf_unlock(psBuf);
 379     if (error) {
 380         /*
 381          * Log some useful information about where the corrupt node is.
 382          */
 383         LFHFS_LOG( LEVEL_ERROR, "lf_hfs: node=%lld fileID=%u volume=%s\n", src->blockNum, VTOC(vp)->c_fileid, VTOVCB(vp)->vcbVN);
 384         hfs_mark_inconsistent(VTOVCB(vp), HFS_INCONSISTENCY_DETECTED);
 385     }
 386     #if DEBUG_BTNODE_SWAP
 387         printf("hfs_swap_BTNode: after: 0x%x, 0x%x, 0x%x, 0x%x\n", pData[0], pData[1], pData[2], pData[3]);
 388     #endif
 389
 390     return (error);
 391 }
 392
 393 int
 394 hfs_swap_HFSPlusBTInternalNode (
 395                                 BlockDescriptor *src,
 396                                 HFSCatalogNodeID fileID,
 397                                 enum HFSBTSwapDirection direction
 398                                 )
 399 {
 400     BTNodeDescriptor *srcDesc = src->buffer;
 401     u_int16_t *srcOffs = (u_int16_t *)((char *)src->buffer + (src->blockSize - (srcDesc->numRecords * sizeof (u_int16_t))));
 402     char *nextRecord;    /*  Points to start of record following current one */
 403
 404     /*
 405      * i is an int32 because it needs to be negative to index the offset to free space.
 406      * srcDesc->numRecords is a u_int16_t and is unlikely to become 32-bit so this should be ok.
 407      */
 408
 409     int32_t i;
 410     u_int32_t j;
 411
 412     if (fileID == kHFSExtentsFileID) {
 413         HFSPlusExtentKey *srcKey;
 414         HFSPlusExtentDescriptor *srcRec;
 415         size_t recordSize;    /* Size of the data part of the record, or node number for index nodes */
 416
 417         if (srcDesc->kind == kBTIndexNode)
 418             recordSize = sizeof(u_int32_t);
 419         else
 420             recordSize = sizeof(HFSPlusExtentDescriptor);
 421
 422         for (i = 0; i < srcDesc->numRecords; i++) {
 423             /* Point to the start of the record we're currently checking. */
 424             srcKey = (HFSPlusExtentKey *)((char *)src->buffer + srcOffs[i]);
 425
 426             /*
 427              * Point to start of next (larger offset) record.  We'll use this
 428              * to be sure the current record doesn't overflow into the next
 429              * record.
 430              */
 431             nextRecord = (char *)src->buffer + srcOffs[i-1];
 432
 433             /*
 434              * Make sure the key and data are within the buffer.  Since both key
 435              * and data are fixed size, this is relatively easy.  Note that this
 436              * relies on the keyLength being a constant; we verify the keyLength
 437              * below.
 438              */
 439             if ((char *)srcKey + sizeof(HFSPlusExtentKey) + recordSize > nextRecord) {
 440
 441                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: extents key #%d offset too big (0x%04X)\n", srcDesc->numRecords-i-1, srcOffs[i]);
 442                 if (direction == kSwapBTNodeHostToBig) {
 443                     hfs_assert(0);
 444                 }
 445                 return fsBTInvalidNodeErr;
 446             }
 447
 448             if (direction == kSwapBTNodeBigToHost)
 449                 srcKey->keyLength = SWAP_BE16 (srcKey->keyLength);
 450             if (srcKey->keyLength != sizeof(*srcKey) - sizeof(srcKey->keyLength)) {
 451
 452                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: extents key #%d invalid length (%d)\n", srcDesc->numRecords-i-1, srcKey->keyLength);
 453                 if (direction == kSwapBTNodeHostToBig) {
 454                     hfs_assert(0);
 455                 }
 456                 return fsBTInvalidNodeErr;
 457             }
 458             srcRec = (HFSPlusExtentDescriptor *)((char *)srcKey + srcKey->keyLength + sizeof(srcKey->keyLength));
 459             if (direction == kSwapBTNodeHostToBig)
 460                 srcKey->keyLength = SWAP_BE16 (srcKey->keyLength);
 461
 462             /* Don't swap srcKey->forkType; it's only one byte */
 463             /* Don't swap srcKey->pad */
 464
 465             srcKey->fileID            = SWAP_BE32 (srcKey->fileID);
 466             srcKey->startBlock        = SWAP_BE32 (srcKey->startBlock);
 467
 468             if (srcDesc->kind == kBTIndexNode) {
 469                 /* For index nodes, the record data is just a child node number. */
 470                 *((u_int32_t *)srcRec) = SWAP_BE32 (*((u_int32_t *)srcRec));
 471             } else {
 472                 /* Swap the extent data */
 473                 for (j = 0; j < kHFSPlusExtentDensity; j++) {
 474                     srcRec[j].startBlock    = SWAP_BE32 (srcRec[j].startBlock);
 475                     srcRec[j].blockCount    = SWAP_BE32 (srcRec[j].blockCount);
 476                 }
 477             }
 478         }
 479
 480     } else if (fileID == kHFSCatalogFileID) {
 481         HFSPlusCatalogKey *srcKey;
 482         int16_t *srcPtr;
 483         u_int16_t keyLength;
 484
 485         for (i = 0; i < srcDesc->numRecords; i++) {
 486             /* Point to the start of the record we're currently checking. */
 487             srcKey = (HFSPlusCatalogKey *)((char *)src->buffer + srcOffs[i]);
 488
 489             /*
 490              * Point to start of next (larger offset) record.  We'll use this
 491              * to be sure the current record doesn't overflow into the next
 492              * record.
 493              */
 494             nextRecord = (char *)src->buffer + (uintptr_t)(srcOffs[i-1]);
 495
 496             /*
 497              * Make sure we can safely dereference the keyLength and parentID fields.
 498              */
 499             if ((char *)srcKey + offsetof(HFSPlusCatalogKey, nodeName.unicode[0]) > nextRecord) {
 500                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog key #%d offset too big (0x%04X)\n", srcDesc->numRecords-i-1, srcOffs[i]);
 501                 if (direction == kSwapBTNodeHostToBig) {
 502                     hfs_assert(0);
 503                 }
 504                 return fsBTInvalidNodeErr;
 505             }
 506
 507             /*
 508              * Swap and sanity check the key length
 509              */
 510             if (direction == kSwapBTNodeBigToHost)
 511                 srcKey->keyLength = SWAP_BE16 (srcKey->keyLength);
 512             keyLength = srcKey->keyLength;    /* Put it in a local (native order) because we use it several times */
 513             if (direction == kSwapBTNodeHostToBig)
 514                 srcKey->keyLength = SWAP_BE16 (keyLength);
 515
 516             /* Sanity check the key length */
 517             if (keyLength < kHFSPlusCatalogKeyMinimumLength || keyLength > kHFSPlusCatalogKeyMaximumLength) {
 518
 519                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog key #%d invalid length (%d)\n", srcDesc->numRecords-i-1, keyLength);
 520                 if (direction == kSwapBTNodeHostToBig) {
 521                     hfs_assert(0);
 522                 }
 523                 return fsBTInvalidNodeErr;
 524             }
 525
 526             /*
 527              * Make sure that we can safely dereference the record's type field or
 528              * an index node's child node number.
 529              */
 530             srcPtr = (int16_t *)((char *)srcKey + keyLength + sizeof(srcKey->keyLength));
 531             if ((char *)srcPtr + sizeof(u_int32_t) > nextRecord) {
 532
 533                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog key #%d too big\n", srcDesc->numRecords-i-1);
 534                 if (direction == kSwapBTNodeHostToBig) {
 535                     hfs_assert(0);
 536                 }
 537                 return fsBTInvalidNodeErr;
 538             }
 539
 540             srcKey->parentID                        = SWAP_BE32 (srcKey->parentID);
 541
 542             /*
 543              * Swap and sanity check the key's node name
 544              */
 545             if (direction == kSwapBTNodeBigToHost)
 546                 srcKey->nodeName.length    = SWAP_BE16 (srcKey->nodeName.length);
 547             /* Make sure name length is consistent with key length */
 548             if (keyLength < sizeof(srcKey->parentID) + sizeof(srcKey->nodeName.length) +
 549                 srcKey->nodeName.length*sizeof(srcKey->nodeName.unicode[0])) {
 550                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog record #%d keyLength=%d expected=%lu\n",
 551                           srcDesc->numRecords-i, keyLength, sizeof(srcKey->parentID) + sizeof(srcKey->nodeName.length) +
 552                           srcKey->nodeName.length*sizeof(srcKey->nodeName.unicode[0]));
 553                 if (direction == kSwapBTNodeHostToBig) {
 554                     hfs_assert(0);
 555                 }
 556                 return fsBTInvalidNodeErr;
 557             }
 558             for (j = 0; j < srcKey->nodeName.length; j++) {
 559                 srcKey->nodeName.unicode[j]    = SWAP_BE16 (srcKey->nodeName.unicode[j]);
 560             }
 561             if (direction == kSwapBTNodeHostToBig)
 562                 srcKey->nodeName.length    = SWAP_BE16 (srcKey->nodeName.length);
 563
 564             /*
 565              * For index nodes, the record data is just the child's node number.
 566              * Skip over swapping the various types of catalog record.
 567              */
 568             if (srcDesc->kind == kBTIndexNode) {
 569                 *((u_int32_t *)srcPtr) = SWAP_BE32 (*((u_int32_t *)srcPtr));
 570                 continue;
 571             }
 572
 573             /* Make sure the recordType is in native order before using it. */
 574             if (direction == kSwapBTNodeBigToHost)
 575                 srcPtr[0] = SWAP_BE16 (srcPtr[0]);
 576
 577             if (srcPtr[0] == kHFSPlusFolderRecord) {
 578                 HFSPlusCatalogFolder *srcRec = (HFSPlusCatalogFolder *)srcPtr;
 579                 if ((char *)srcRec + sizeof(*srcRec) > nextRecord) {
 580
 581                     LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog folder record #%d too big\n", srcDesc->numRecords-i-1);
 582                     if (direction == kSwapBTNodeHostToBig) {
 583                         hfs_assert(0);
 584                     }
 585                     return fsBTInvalidNodeErr;
 586                 }
 587
 588                 srcRec->flags                = SWAP_BE16 (srcRec->flags);
 589                 srcRec->valence                = SWAP_BE32 (srcRec->valence);
 590                 srcRec->folderID            = SWAP_BE32 (srcRec->folderID);
 591                 srcRec->createDate            = SWAP_BE32 (srcRec->createDate);
 592                 srcRec->contentModDate        = SWAP_BE32 (srcRec->contentModDate);
 593                 srcRec->attributeModDate    = SWAP_BE32 (srcRec->attributeModDate);
 594                 srcRec->accessDate            = SWAP_BE32 (srcRec->accessDate);
 595                 srcRec->backupDate            = SWAP_BE32 (srcRec->backupDate);
 596
 597                 srcRec->bsdInfo.ownerID        = SWAP_BE32 (srcRec->bsdInfo.ownerID);
 598                 srcRec->bsdInfo.groupID        = SWAP_BE32 (srcRec->bsdInfo.groupID);
 599
 600                 /* Don't swap srcRec->bsdInfo.adminFlags; it's only one byte */
 601                 /* Don't swap srcRec->bsdInfo.ownerFlags; it's only one byte */
 602
 603                 srcRec->bsdInfo.fileMode            = SWAP_BE16 (srcRec->bsdInfo.fileMode);
 604                 srcRec->bsdInfo.special.iNodeNum    = SWAP_BE32 (srcRec->bsdInfo.special.iNodeNum);
 605
 606                 srcRec->textEncoding        = SWAP_BE32 (srcRec->textEncoding);
 607
 608                 /* Don't swap srcRec->userInfo */
 609                 /* Don't swap srcRec->finderInfo */
 610                 srcRec->folderCount = SWAP_BE32 (srcRec->folderCount);
 611
 612             } else if (srcPtr[0] == kHFSPlusFileRecord) {
 613                 HFSPlusCatalogFile *srcRec = (HFSPlusCatalogFile *)srcPtr;
 614                 if ((char *)srcRec + sizeof(*srcRec) > nextRecord) {
 615
 616                     LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog file record #%d too big\n", srcDesc->numRecords-i-1);
 617                     if (direction == kSwapBTNodeHostToBig) {
 618                         hfs_assert(0);
 619                     }
 620                     return fsBTInvalidNodeErr;
 621                 }
 622
 623                 srcRec->flags                = SWAP_BE16 (srcRec->flags);
 624
 625                 srcRec->fileID               = SWAP_BE32 (srcRec->fileID);
 626
 627                 srcRec->createDate           = SWAP_BE32 (srcRec->createDate);
 628                 srcRec->contentModDate       = SWAP_BE32 (srcRec->contentModDate);
 629                 srcRec->attributeModDate     = SWAP_BE32 (srcRec->attributeModDate);
 630                 srcRec->accessDate           = SWAP_BE32 (srcRec->accessDate);
 631                 srcRec->backupDate           = SWAP_BE32 (srcRec->backupDate);
 632
 633                 srcRec->bsdInfo.ownerID      = SWAP_BE32 (srcRec->bsdInfo.ownerID);
 634                 srcRec->bsdInfo.groupID      = SWAP_BE32 (srcRec->bsdInfo.groupID);
 635
 636                 /* Don't swap srcRec->bsdInfo.adminFlags; it's only one byte */
 637                 /* Don't swap srcRec->bsdInfo.ownerFlags; it's only one byte */
 638
 639                 srcRec->bsdInfo.fileMode            = SWAP_BE16 (srcRec->bsdInfo.fileMode);
 640                 srcRec->bsdInfo.special.iNodeNum    = SWAP_BE32 (srcRec->bsdInfo.special.iNodeNum);
 641
 642                 srcRec->textEncoding        = SWAP_BE32 (srcRec->textEncoding);
 643
 644                 /* If kHFSHasLinkChainBit is set, reserved1 is hl_FirstLinkID.
 645                  * In all other context, it is expected to be zero.
 646                  */
 647                 srcRec->reserved1 = SWAP_BE32 (srcRec->reserved1);
 648
 649                 /* Don't swap srcRec->userInfo */
 650                 /* Don't swap srcRec->finderInfo */
 651                 /* Don't swap srcRec->reserved2 */
 652
 653                 hfs_swap_HFSPlusForkData (&srcRec->dataFork);
 654                 hfs_swap_HFSPlusForkData (&srcRec->resourceFork);
 655
 656             } else if ((srcPtr[0] == kHFSPlusFolderThreadRecord) ||
 657                        (srcPtr[0] == kHFSPlusFileThreadRecord)) {
 658
 659                 /*
 660                  * Make sure there is room for parentID and name length.
 661                  */
 662                 HFSPlusCatalogThread *srcRec = (HFSPlusCatalogThread *)srcPtr;
 663                 if ((char *) &srcRec->nodeName.unicode[0] > nextRecord) {
 664                     LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog thread record #%d too big\n", srcDesc->numRecords-i-1);
 665                     if (direction == kSwapBTNodeHostToBig) {
 666                         hfs_assert(0);
 667                     }
 668                     return fsBTInvalidNodeErr;
 669                 }
 670
 671                 /* Don't swap srcRec->reserved */
 672
 673                 srcRec->parentID                        = SWAP_BE32 (srcRec->parentID);
 674
 675                 if (direction == kSwapBTNodeBigToHost)
 676                     srcRec->nodeName.length    = SWAP_BE16 (srcRec->nodeName.length);
 677
 678                 /*
 679                  * Make sure there is room for the name in the buffer.
 680                  * Then swap the characters of the name itself.
 681                  */
 682                 if ((char *) &srcRec->nodeName.unicode[srcRec->nodeName.length] > nextRecord) {
 683                     LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: catalog thread record #%d name too big\n", srcDesc->numRecords-i-1);
 684                     if (direction == kSwapBTNodeHostToBig) {
 685                         hfs_assert(0);
 686                     }
 687                     return fsBTInvalidNodeErr;
 688                 }
 689                 for (j = 0; j < srcRec->nodeName.length; j++) {
 690                     srcRec->nodeName.unicode[j]    = SWAP_BE16 (srcRec->nodeName.unicode[j]);
 691                 }
 692
 693                 if (direction == kSwapBTNodeHostToBig)
 694                     srcRec->nodeName.length = SWAP_BE16 (srcRec->nodeName.length);
 695
 696             } else {
 697                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: unrecognized catalog record type (0x%04X; record #%d)\n", srcPtr[0], srcDesc->numRecords-i-1);
 698                 if (direction == kSwapBTNodeHostToBig) {
 699                     hfs_assert(0);
 700                 }
 701                 return fsBTInvalidNodeErr;
 702             }
 703
 704             /* We can swap the record type now that we're done using it. */
 705             if (direction == kSwapBTNodeHostToBig)
 706                 srcPtr[0] = SWAP_BE16 (srcPtr[0]);
 707         }
 708
 709     } else if (fileID == kHFSAttributesFileID) {
 710         HFSPlusAttrKey *srcKey;
 711         HFSPlusAttrRecord *srcRec;
 712         u_int16_t keyLength;
 713         u_int32_t attrSize = 0;
 714
 715         for (i = 0; i < srcDesc->numRecords; i++) {
 716             /* Point to the start of the record we're currently checking. */
 717             srcKey = (HFSPlusAttrKey *)((char *)src->buffer + srcOffs[i]);
 718
 719             /*
 720              * Point to start of next (larger offset) record.  We'll use this
 721              * to be sure the current record doesn't overflow into the next
 722              * record.
 723              */
 724             nextRecord = (char *)src->buffer + srcOffs[i-1];
 725
 726             /* Make sure there is room in the buffer for a minimal key */
 727             if ((char *) &srcKey->attrName[1] > nextRecord) {
 728                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: attr key #%d offset too big (0x%04X)\n", srcDesc->numRecords-i-1, srcOffs[i]);
 729                 if (direction == kSwapBTNodeHostToBig) {
 730                     hfs_assert(0);
 731                 }
 732                 return fsBTInvalidNodeErr;
 733             }
 734
 735             /* Swap the key length field */
 736             if (direction == kSwapBTNodeBigToHost)
 737                 srcKey->keyLength = SWAP_BE16(srcKey->keyLength);
 738             keyLength = srcKey->keyLength;    /* Keep a copy in native order */
 739             if (direction == kSwapBTNodeHostToBig)
 740                 srcKey->keyLength = SWAP_BE16(srcKey->keyLength);
 741
 742             /*
 743              * Make sure that we can safely dereference the record's type field or
 744              * an index node's child node number.
 745              */
 746             srcRec = (HFSPlusAttrRecord *)((char *)srcKey + keyLength + sizeof(srcKey->keyLength));
 747             if ((char *)srcRec + sizeof(u_int32_t) > nextRecord) {
 748                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: attr key #%d too big (%d)\n", srcDesc->numRecords-i-1, keyLength);
 749                 if (direction == kSwapBTNodeHostToBig) {
 750                     hfs_assert(0);
 751                 }
 752                 return fsBTInvalidNodeErr;
 753             }
 754
 755             srcKey->fileID = SWAP_BE32(srcKey->fileID);
 756             srcKey->startBlock = SWAP_BE32(srcKey->startBlock);
 757
 758             /*
 759              * Swap and check the attribute name
 760              */
 761             if (direction == kSwapBTNodeBigToHost)
 762                 srcKey->attrNameLen = SWAP_BE16(srcKey->attrNameLen);
 763             /* Sanity check the attribute name length */
 764             if (srcKey->attrNameLen > kHFSMaxAttrNameLen || keyLength < (kHFSPlusAttrKeyMinimumLength + sizeof(u_int16_t)*srcKey->attrNameLen)) {
 765
 766                 LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: attr key #%d keyLength=%d attrNameLen=%d\n", srcDesc->numRecords-i-1, keyLength, srcKey->attrNameLen);
 767                 if (direction == kSwapBTNodeHostToBig) {
 768                     hfs_assert(0);
 769                 }
 770                 return fsBTInvalidNodeErr;
 771             }
 772             for (j = 0; j < srcKey->attrNameLen; j++)
 773                 srcKey->attrName[j] = SWAP_BE16(srcKey->attrName[j]);
 774             if (direction == kSwapBTNodeHostToBig)
 775                 srcKey->attrNameLen = SWAP_BE16(srcKey->attrNameLen);
 776
 777             /*
 778              * For index nodes, the record data is just the child's node number.
 779              * Skip over swapping the various types of attribute record.
 780              */
 781             if (srcDesc->kind == kBTIndexNode) {
 782                 *((u_int32_t *)srcRec) = SWAP_BE32 (*((u_int32_t *)srcRec));
 783                 continue;
 784             }
 785
 786             /* Swap the record data */
 787             if (direction == kSwapBTNodeBigToHost)
 788                 srcRec->recordType = SWAP_BE32(srcRec->recordType);
 789             switch (srcRec->recordType) {
 790                 case kHFSPlusAttrInlineData:
 791                     /* Is there room for the inline data header? */
 792                     if ((char *) &srcRec->attrData.attrData[0]  > nextRecord) {
 793
 794                         LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: attr inline #%d too big\n", srcDesc->numRecords-i-1);
 795                         if (direction == kSwapBTNodeHostToBig) {
 796                             hfs_assert(0);
 797                         }
 798                         return fsBTInvalidNodeErr;
 799                     }
 800
 801                     /* We're not swapping the reserved fields */
 802
 803                     /* Swap the attribute size */
 804                     if (direction == kSwapBTNodeHostToBig)
 805                         attrSize = srcRec->attrData.attrSize;
 806                     srcRec->attrData.attrSize = SWAP_BE32(srcRec->attrData.attrSize);
 807                     if (direction == kSwapBTNodeBigToHost)
 808                         attrSize = srcRec->attrData.attrSize;
 809
 810                     /* Is there room for the inline attribute data? */
 811                     if ((char *) &srcRec->attrData.attrData[attrSize] > nextRecord) {
 812                         LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: attr inline #%d too big (attrSize=%u)\n", srcDesc->numRecords-i-1, attrSize);
 813                         if (direction == kSwapBTNodeHostToBig) {
 814                             hfs_assert(0);
 815                         }
 816                         return fsBTInvalidNodeErr;
 817                     }
 818
 819                     /* Not swapping the attribute data itself */
 820                     break;
 821
 822                 case kHFSPlusAttrForkData:
 823                     /* Is there room for the fork data record? */
 824                     if ((char *)srcRec + sizeof(HFSPlusAttrForkData) > nextRecord) {
 825                         LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: attr fork data #%d too big\n", srcDesc->numRecords-i-1);
 826                         if (direction == kSwapBTNodeHostToBig) {
 827                             hfs_assert(0);
 828                         }
 829                         return fsBTInvalidNodeErr;
 830                     }
 831
 832                     /* We're not swapping the reserved field */
 833
 834                     hfs_swap_HFSPlusForkData(&srcRec->forkData.theFork);
 835                     break;
 836
 837                 case kHFSPlusAttrExtents:
 838                     /* Is there room for an extent record? */
 839                     if ((char *)srcRec + sizeof(HFSPlusAttrExtents) > nextRecord) {
 840                         LFHFS_LOG((direction == kSwapBTNodeHostToBig) ? LEVEL_ERROR : LEVEL_DEBUG, "hfs_swap_HFSPlusBTInternalNode: attr extents #%d too big\n", srcDesc->numRecords-i-1);
 841                         if (direction == kSwapBTNodeHostToBig) {
 842                             hfs_assert(0);
 843                         }
 844                         return fsBTInvalidNodeErr;
 845                     }
 846
 847                     /* We're not swapping the reserved field */
 848
 849                     for (j = 0; j < kHFSPlusExtentDensity; j++) {
 850                         srcRec->overflowExtents.extents[j].startBlock =
 851                         SWAP_BE32(srcRec->overflowExtents.extents[j].startBlock);
 852                         srcRec->overflowExtents.extents[j].blockCount =
 853                         SWAP_BE32(srcRec->overflowExtents.extents[j].blockCount);
 854                     }
 855                     break;
 856             }
 857             if (direction == kSwapBTNodeHostToBig)
 858                 srcRec->recordType = SWAP_BE32(srcRec->recordType);
 859         }
 860     }
 861     else {
 862         LFHFS_LOG(LEVEL_ERROR, "hfs_swap_HFSPlusBTInternalNode: fileID %u is not a system B-tree\n", fileID);
 863         hfs_assert(0);
 864     }
 865
 866
 867     return (0);
 868 }
 869