1 files changed, 7 insertions, 2 deletions

diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
index 0f1b3a2654b9..ac10ca939f26 100644
--- a/fs/udf/symlink.c
+++ b/fs/udf/symlink.c
@@ -42,14 +42,17 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
         tolen--;
         while (elen < fromlen) {
                 pc = (struct pathComponent *)(from + elen);
+                elen += sizeof(struct pathComponent);
                 switch (pc->componentType) {
                 case 1:
                         /*
                          * Symlink points to some place which should be agreed
                          * upon between originator and receiver of the media. Ignore.
                          */
-                        if (pc->lengthComponentIdent > 0)
+                        if (pc->lengthComponentIdent > 0) {
+                                elen += pc->lengthComponentIdent;
                                 break;
+                        }
                         /* Fall through */
                 case 2:
                         if (tolen == 0)
@@ -74,6 +77,9 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
                         /* that would be . - just ignore */
                         break;
                 case 5:
+                        elen += pc->lengthComponentIdent;
+                        if (elen > fromlen)
+                                return -EIO;
                         comp_len = udf_get_filename(sb, pc->componentIdent,
                                                     pc->lengthComponentIdent,
                                                     p, tolen);
@@ -85,7 +91,6 @@ static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
                         tolen--;
                         break;
                 }
-                elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
         }
         if (p > to + 1)
                 p[-1] = '\0';