commit 49d0fe2a14f2a23da2fe299643379b8c1d37df73
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Fri Feb 6 12:46:39 2015 -0500

    libext2fs: fix potential buffer overflow in closefs()
    
    The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if
    s_first_meta_bg is too big" had a typo in the fix for
    ext2fs_closefs().  In practice most of the security exposure was from
    the openfs path, since this meant if there was a carefully crafted
    file system, buffer overrun would be triggered when the file system was
    opened.
    
    However, if corrupted file system didn't trip over some corruption
    check, and then the file system was modified via tune2fs or debugfs,
    such that the superblock was marked dirty and then written out via the
    closefs() path, it's possible that the buffer overrun could be
    triggered when the file system is closed.
    
    Also clear up a signed vs unsigned warning while we're at it.
    
    Thanks to Nick Kralevich <nnk@google.com> for asking me to look at
    compiler warning in the code in question, which led me to notice the
    bug in f66e6ce4446.
    
    Addresses: CVE-2015-1572
    
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Index: e2fsprogs-1.42.9/lib/ext2fs/closefs.c
===================================================================
--- e2fsprogs-1.42.9.orig/lib/ext2fs/closefs.c
+++ e2fsprogs-1.42.9/lib/ext2fs/closefs.c
@@ -279,7 +279,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, 
 	dgrp_t		j;
 #endif
 	char	*group_ptr;
-	int	old_desc_blocks;
+	blk64_t	old_desc_blocks;
 	struct ext2fs_numeric_progress_struct progress;
 
 	EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
@@ -338,7 +338,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, 
 	group_ptr = (char *) group_shadow;
 	if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
 		old_desc_blocks = fs->super->s_first_meta_bg;
-		if (old_desc_blocks > fs->super->s_first_meta_bg)
+		if (old_desc_blocks > fs->desc_blocks)
 			old_desc_blocks = fs->desc_blocks;
 	} else
 		old_desc_blocks = fs->desc_blocks;