libext2fs: validate block # of the inode table in ext2fs_image_inode_write()

Signed-off-by: Theodore Ts'o <tytso@mit.edu>

diff --git a/lib/ext2fs/imager.c b/lib/ext2fs/imager.c
index b56e0e9..6f8582a 100644 (file)
--- a/lib/ext2fs/imager.c
+++ b/lib/ext2fs/imager.c
@@ -80,6 +80,11 @@ errcode_t ext2fs_image_inode_write(ext2_filsys fs, int fd, int flags)
                        goto errout;
                }
                left = fs->inode_blocks_per_group;
+               if ((blk < fs->super->s_first_data_block) ||
+                   (blk + left - 1 >= ext2fs_blocks_count(fs->super))) {
+                       retval = EXT2_ET_GDESC_BAD_INODE_TABLE;
+                       goto errout;
+               }
                while (left) {
                        c = BUF_BLOCKS;
                        if (c > left)