diff --git a/sys/vfs/ntfs/ntfs_compr.c b/sys/vfs/ntfs/ntfs_compr.c --- a/sys/vfs/ntfs/ntfs_compr.c +++ b/sys/vfs/ntfs/ntfs_compr.c @@ -102,12 +102,14 @@ int off = 0; int new; - for (i = 0; i * NTFS_COMPBLOCK_SIZE < ntfs_cntob(NTFS_COMPUNIT_CL); i++) { - new = ntfs_uncompblock(uup + i * NTFS_COMPBLOCK_SIZE, cup + off); - if (new == 0) - return (EINVAL); - off += new; - } + for (i = 0; i * NTFS_COMPBLOCK_SIZE < ntfs_cntob(NTFS_COMPUNIT_CL); i++) { + if (off < 0 || off + 2 > ntfs_cntob(NTFS_COMPUNIT_CL)) + return (EINVAL); + new = ntfs_uncompblock(uup + i * NTFS_COMPBLOCK_SIZE, cup + off); + if (new == 0) + return (EINVAL); + off += new; + } return (0); }