--- download/linux-2.6.29-rc7-vanilla-extcheck/fs/ext4/inode.c	2009-03-12 16:10:31.000000000 +0100
+++ linux-2.6.29-rc7/fs/ext4/inode.c	2009-03-12 16:09:27.000000000 +0100
@@ -371,6 +371,34 @@
 	return n;
 }
 
+static int __ext4_check_blockref(const char *function, struct inode *inode,
+				 unsigned int *p, unsigned int max) {
+
+	struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
+	unsigned int offset = 0;
+	while (offset < max && p[offset]) {
+		if (unlikely(p[offset] < le32_to_cpu(es->s_first_data_block) ||
+			     (p[offset] > ext4_blocks_count(es)))) {
+			ext4_error(inode->i_sb, function,
+				   "bad block reference in inode #%lu, "
+				   "offset=%u, blockref=%u",
+				   inode->i_ino, offset, p[offset]);
+			return -EIO;
+		}
+		offset++;
+	}
+	return 0;
+}
+
+
+#define ext4_check_indirect_blockref(inode, bh)                         \
+        __ext4_check_blockref(__func__, inode, (__le32 *)(bh)->b_data,  \
+			      EXT4_ADDR_PER_BLOCK((inode)->i_sb))
+
+#define ext4_check_inode_blockref(inode)                                \
+        __ext4_check_blockref(__func__, inode, EXT4_I(inode)->i_data,   \
+			      EXT4_NDIR_BLOCKS)
+
 /**
  *	ext4_get_branch - read the chain of indirect blocks leading to data
  *	@inode: inode in question
@@ -418,6 +446,9 @@
 		bh = sb_bread(sb, le32_to_cpu(p->key));
 		if (!bh)
 			goto failure;
+		if (ext4_check_indirect_blockref(inode, bh))
+			goto failure;
+                  
 		add_chain(++p, bh, (__le32 *)bh->b_data + *++offsets);
 		/* Reader: end */
 		if (!p->key)
@@ -4302,11 +4333,13 @@
 	if (ei->i_flags & EXT4_EXTENTS_FL) {
 		/* Validate extent which is part of inode */
 		ret = ext4_ext_check_inode(inode);
-		if (ret) {
-			brelse(bh);
-			goto bad_inode;
-		}
-
+ 	} else {
+	 	/* Validate block references which are part of inode */
+		ret = ext4_check_inode_blockref(inode);
+	}
+	if (ret) {
+ 		brelse(bh);
+ 		goto bad_inode;
 	}
 
 	if (S_ISREG(inode->i_mode)) {