diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c
index 17eb275a21ff..9eaadbc0ef47 100644
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -897,6 +897,28 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume *
 				goto err_out;
 			}
 
+			if (lcn >= 0) {
+				s64 run_end;
+
+				/*
+				 * Ensure that the run stays within the volume.
+				 * A valid starting LCN is not sufficient because
+				 * the run length comes from disk.
+				 */
+				if (unlikely(check_add_overflow(lcn,
+						rl[rlpos].length,
+						&run_end))) {
+					ntfs_error(vol->sb,
+							"Run length overflow in mapping pairs array.");
+					goto err_out;
+				}
+				if (unlikely(run_end > (s64)vol->nr_clusters)) {
+					ntfs_error(vol->sb,
+							"Run extends beyond volume boundary.");
+					goto err_out;
+				}
+			}
+
 			/* chkdsk accepts zero-sized runs only for holes */
 			if ((lcn != -1) && !rl[rlpos].length) {
 				ntfs_error(vol->sb,