@@ -631,6 +631,11 @@ static errcode_t ext2fs_journal_load(journal_t *journal)
else if (ntohl(jsb->s_maxlen) > journal->j_total_len)
return EXT2_ET_CORRUPT_JOURNAL_SB;
+ if (jsb->s_head != 0 &&
+ (ntohl(jsb->s_head) < ntohl(jsb->s_first) ||
+ ntohl(jsb->s_head) >= journal->j_total_len))
+ return EXT2_ET_CORRUPT_JOURNAL_SB;
+
journal->j_tail_sequence = ntohl(jsb->s_sequence);
journal->j_transaction_sequence = journal->j_tail_sequence;
journal->j_tail = ntohl(jsb->s_start);
@@ -1374,6 +1374,15 @@ static errcode_t e2fsck_journal_load(journal_t *journal)
return EXT2_ET_CORRUPT_JOURNAL_SB;
}
+ if (jsb->s_head != 0 &&
+ (ntohl(jsb->s_head) < ntohl(jsb->s_first) ||
+ ntohl(jsb->s_head) >= journal->j_total_len)) {
+ com_err(ctx->program_name, EXT2_ET_CORRUPT_JOURNAL_SB,
+ _("%s, journal head out of bounds\n"),
+ ctx->device_name);
+ return EXT2_ET_CORRUPT_JOURNAL_SB;
+ }
+
journal->j_tail_sequence = ntohl(jsb->s_sequence);
journal->j_transaction_sequence = journal->j_tail_sequence;
journal->j_tail = ntohl(jsb->s_start);