diff --git a/fs/udf/super.c b/fs/udf/super.c index cad2e15d633b..d75bfc733975 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -1418,7 +1418,8 @@ static int udf_load_sparable_map(struct super_block *sb, if (ident != 0 || strncmp(st->sparingIdent.ident, UDF_ID_SPARING, strlen(UDF_ID_SPARING)) || - sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > + struct_size(st, mapEntry, + le16_to_cpu(st->reallocationTableLen)) > sb->s_blocksize) { brelse(bh); continue;