diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c index 476a7ff49482..5e9e07e59c84 100644 --- a/fs/reiserfs/stree.c +++ b/fs/reiserfs/stree.c @@ -391,6 +391,7 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) { struct block_head *blkh; struct item_head *ih; + struct reiserfs_de_head *deh; int used_space; int prev_location; int i; @@ -454,11 +455,24 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) "(second one): %h", ih); return 0; } - if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) { - reiserfs_warning(NULL, "reiserfs-5093", - "item entry count seems wrong %h", - ih); - return 0; + if (is_direntry_le_ih(ih)) { + if (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE)) { + reiserfs_warning(NULL, "reiserfs-5093", + "item entry count seems wrong %h", + ih); + return 0; + } else { + deh = B_I_DEH(bh, ih); + for (i = 0; i < ih_entry_count(ih); i++) { + if (deh_location(&deh[i]) > ih_item_len(ih)) { + reiserfs_warning(NULL, + "reiserfs-5094", + "Invalid directry %h", + &deh[i]); + return 0; + } + } + } } prev_location = ih_location(ih); }