libext2fs: avoid buffer overflow if s_first_meta_bg is too big

[tools/e2fsprogs.git] / lib / ext2fs / closefs.c

diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
index 4599eef..1f99113 100644 (file)
--- a/lib/ext2fs/closefs.c
+++ b/lib/ext2fs/closefs.c
@@ -344,9 +344,11 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
         * superblocks and group descriptors.
         */
        group_ptr = (char *) group_shadow;
-       if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
+       if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
                old_desc_blocks = fs->super->s_first_meta_bg;
-       else
+               if (old_desc_blocks > fs->super->s_first_meta_bg)
+                       old_desc_blocks = fs->desc_blocks;
+       } else
                old_desc_blocks = fs->desc_blocks;
 
        ext2fs_numeric_progress_init(fs, &progress, NULL,