diff --git a/fs/udf/super.c b/fs/udf/super.c index 7f1ddbce0cb2..1debc30203b3 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -1395,7 +1395,8 @@ static int udf_load_sparable_map(struct super_block *sb, if (ident != 0 || strncmp(st->sparingIdent.ident, UDF_ID_SPARING, strlen(UDF_ID_SPARING)) || - sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > + struct_size(st, mapEntry, + le16_to_cpu(st->reallocationTableLen)) > sb->s_blocksize) { brelse(bh); continue;