diff --git a/fs/udf/super.c b/fs/udf/super.c index 266caa70f856..4c6ce8c1344b 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -1397,7 +1397,8 @@ static int udf_load_sparable_map(struct super_block *sb, if (ident != 0 || strncmp(st->sparingIdent.ident, UDF_ID_SPARING, strlen(UDF_ID_SPARING)) || - sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > + struct_size(st, mapEntry, + le16_to_cpu(st->reallocationTableLen)) > sb->s_blocksize) { brelse(bh); continue;