1 files changed, 38 insertions, 7 deletions

diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c
index cd11b23a1875..db8bd0e518b2 100644
--- a/fs/ubifs/lpt.c
+++ b/fs/ubifs/lpt.c
@@ -288,25 +288,56 @@ uint32_t ubifs_unpack_bits(uint8_t **addr, int *pos, int nrbits)
         const int k = 32 - nrbits;
         uint8_t *p = *addr;
         int b = *pos;
-        uint32_t val;
+        uint32_t uninitialized_var(val);
+        const int bytes = (nrbits + b + 7) >> 3;
 
         ubifs_assert(nrbits > 0);
         ubifs_assert(nrbits <= 32);
         ubifs_assert(*pos >= 0);
         ubifs_assert(*pos < 8);
         if (b) {
-                val = p[1] | ((uint32_t)p[2] << 8) | ((uint32_t)p[3] << 16) |
-                      ((uint32_t)p[4] << 24);
+                switch (bytes) {
+                case 2:
+                        val = p[1];
+                        break;
+                case 3:
+                        val = p[1] | ((uint32_t)p[2] << 8);
+                        break;
+                case 4:
+                        val = p[1] | ((uint32_t)p[2] << 8) |
+                                     ((uint32_t)p[3] << 16);
+                        break;
+                case 5:
+                        val = p[1] | ((uint32_t)p[2] << 8) |
+                                     ((uint32_t)p[3] << 16) |
+                                     ((uint32_t)p[4] << 24);
+                }
                 val <<= (8 - b);
                 val |= *p >> b;
                 nrbits += b;
-        } else
-                val = p[0] | ((uint32_t)p[1] << 8) | ((uint32_t)p[2] << 16) |
-                      ((uint32_t)p[3] << 24);
+        } else {
+                switch (bytes) {
+                case 1:
+                        val = p[0];
+                        break;
+                case 2:
+                        val = p[0] | ((uint32_t)p[1] << 8);
+                        break;
+                case 3:
+                        val = p[0] | ((uint32_t)p[1] << 8) |
+                                     ((uint32_t)p[2] << 16);
+                        break;
+                case 4:
+                        val = p[0] | ((uint32_t)p[1] << 8) |
+                                     ((uint32_t)p[2] << 16) |
+                                     ((uint32_t)p[3] << 24);
+                        break;
+                }
+        }
         val <<= k;
         val >>= k;
         b = nrbits & 7;
-        p += nrbits / 8;
+        p += nrbits >> 3;
         *addr = p;
         *pos = b;
         ubifs_assert((val >> nrbits) == 0 || nrbits - b == 32);