diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 4726a4d014b6..811a035b600f 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2215,9 +2215,10 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, if (!epos->offset) epos->offset = sizeof(struct allocExtDesc); ptr = epos->bh->b_data + epos->offset; - alen = sizeof(struct allocExtDesc) + - le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> - lengthAllocDescs); + if (check_add_overflow(sizeof(struct allocExtDesc), + le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data) + ->lengthAllocDescs), &alen)) + return -1; } switch (iinfo->i_alloc_type) {