diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 48be49cffbc0739ba6a3ac0414692a0071c68f94..44e81e1657c4482f64a073bc7f49fe8de4f8efe6 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2139,6 +2139,9 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, alen = sizeof(struct allocExtDesc) + le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> lengthAllocDescs); + + if (alen > epos->bh->b_size) + return -1; } switch (iinfo->i_alloc_type) {