From 21e41eeef968941c1ee0126852fdb705967730ea Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Fri, 8 Nov 2019 11:58:10 -0500
Subject: [PATCH 05/10] libext2fs: verify the block numbers for the allocation
 bitmaps are valid

This avoids a potential UBsan failure when we multiply an insanely
high block number with the block size and we get a multiplication
overflow.

Google-Bug-Id: 128130353
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
 lib/ext2fs/rw_bitmaps.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/ext2fs/rw_bitmaps.c b/lib/ext2fs/rw_bitmaps.c
index e092cab0..d80c9eb8 100644
--- a/lib/ext2fs/rw_bitmaps.c
+++ b/lib/ext2fs/rw_bitmaps.c
@@ -306,9 +306,10 @@ static errcode_t read_bitmaps(ext2_filsys fs, int do_inode, int do_block)
 	for (i = 0; i < fs->group_desc_count; i++) {
 		if (block_bitmap) {
 			blk = ext2fs_block_bitmap_loc(fs, i);
-			if (csum_flag &&
-			    ext2fs_bg_flags_test(fs, i, EXT2_BG_BLOCK_UNINIT) &&
-			    ext2fs_group_desc_csum_verify(fs, i))
+			if ((csum_flag &&
+			     ext2fs_bg_flags_test(fs, i, EXT2_BG_BLOCK_UNINIT) &&
+			     ext2fs_group_desc_csum_verify(fs, i)) ||
+			    (blk >= ext2fs_blocks_count(fs->super)))
 				blk = 0;
 			if (blk) {
 				retval = io_channel_read_blk64(fs->io, blk,
@@ -340,9 +341,10 @@ static errcode_t read_bitmaps(ext2_filsys fs, int do_inode, int do_block)
 		}
 		if (inode_bitmap) {
 			blk = ext2fs_inode_bitmap_loc(fs, i);
-			if (csum_flag &&
-			    ext2fs_bg_flags_test(fs, i, EXT2_BG_INODE_UNINIT) &&
-			    ext2fs_group_desc_csum_verify(fs, i))
+			if ((csum_flag &&
+			     ext2fs_bg_flags_test(fs, i, EXT2_BG_INODE_UNINIT) &&
+			     ext2fs_group_desc_csum_verify(fs, i)) ||
+			    (blk >= ext2fs_blocks_count(fs->super)))
 				blk = 0;
 			if (blk) {
 				retval = io_channel_read_blk64(fs->io, blk,
-- 
2.21.1