Index: e2fsprogs-1.41.1/e2fsck/pass1.c
===================================================================
--- e2fsprogs-1.41.1.orig/e2fsck/pass1.c	2008-08-28 19:56:31.000000000 +0530
+++ e2fsprogs-1.41.1/e2fsck/pass1.c	2009-02-04 16:21:14.000000000 +0530
@@ -318,6 +318,13 @@
 			goto fix;
 		}
 
+		/* Value size cannot be larger than EA space in inode */
+		if (entry->e_value_offs > storage_size ||
+		    entry->e_value_offs + entry->e_value_size > storage_size) {
+			problem = PR_1_INODE_EA_BAD_VALUE;
+			goto fix;
+		}
+
 		hash = ext2fs_ext_attr_hash_entry(entry,
 						  start + entry->e_value_offs);
 
Index: e2fsprogs-1.41.1/e2fsck/problem.c
===================================================================
--- e2fsprogs-1.41.1.orig/e2fsck/problem.c	2008-08-28 19:56:31.000000000 +0530
+++ e2fsprogs-1.41.1/e2fsck/problem.c	2009-02-04 16:20:06.000000000 +0530
@@ -908,6 +908,11 @@
 	  N_("Pass 1C: Scanning directories for @is with @m @bs\n"),
 	  PROMPT_NONE, 0 },
 
+	/* Bad extended attribute value in inode */
+        { PR_1_INODE_EA_BAD_VALUE,
+          N_("@a in @i %i is corrupt (@n value)."),
+          PROMPT_CLEAR, 0},
+
 
 	/* Pass 1D: Reconciling multiply-claimed blocks */
 	{ PR_1D_PASS_HEADER,
Index: e2fsprogs-1.41.1/e2fsck/problem.h
===================================================================
--- e2fsprogs-1.41.1.orig/e2fsck/problem.h	2008-08-28 08:37:00.000000000 +0530
+++ e2fsprogs-1.41.1/e2fsck/problem.h	2009-02-04 16:20:06.000000000 +0530
@@ -560,6 +560,9 @@
 /* Couldn't clone file (error) */
 #define PR_1D_CLONE_ERROR	0x013008
 
+/* Bad extended attribute value in inode */
+#define PR_1_INODE_EA_BAD_VALUE		0x01006D
+
 /*
  * Pass 2 errors
  */