[PATCH v2] erofs-utils: lib: error out if fragment_off is crafted

[Gao Xiang]

Found in some fuzzed images.

Fixes: f511cfbbc0da ("erofs-utils: introduce fragment cache")
Signed-off-by: Gao Xiang <hsiang...@linux.alibaba.com>
---
 lib/fragments.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/fragments.c b/lib/fragments.c
index 2f5fbf9..05bbf0d 100644
--- a/lib/fragments.c
+++ b/lib/fragments.c
@@ -524,6 +524,11 @@ int erofs_packedfile_read(struct erofs_sb_info *sbi,
                        erofs_blk_t bnr = erofs_blknr(sbi, pos);
                        bool uptodate;
 
+                       if (__erofs_unlikely(bnr > (epi->uptodate_size << 3))) {
+                               erofs_err("packed inode EOF exceeded @ %llu",
+                                         pos | 0ULL);
+                               return -EFSCORRUPTED;
+                       }
                        map.m_la = round_down(pos, bsz);
                        len = min_t(erofs_off_t, bsz - (pos & (bsz - 1)),
                                    end - pos);
-- 
2.43.5