libext2fs: avoid buffer overflow if s_first_meta_bg is too big

[tools/e2fsprogs.git] / lib / ext2fs / openfs.c

diff --git a/lib/ext2fs/openfs.c b/lib/ext2fs/openfs.c
index a1a3517..ba501e6 100644 (file)
--- a/lib/ext2fs/openfs.c
+++ b/lib/ext2fs/openfs.c
@@ -378,9 +378,11 @@ errcode_t ext2fs_open2(const char *name, const char *io_options,
 #ifdef WORDS_BIGENDIAN
        groups_per_block = EXT2_DESC_PER_BLOCK(fs->super);
 #endif
-       if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG)
+       if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
                first_meta_bg = fs->super->s_first_meta_bg;
-       else
+               if (first_meta_bg > fs->desc_blocks)
+                       first_meta_bg = fs->desc_blocks;
+       } else
                first_meta_bg = fs->desc_blocks;
        if (first_meta_bg) {
                retval = io_channel_read_blk(fs->io, group_block +