diff --git a/src/shared/btrfs-util.c b/src/shared/btrfs-util.c
index 780c1be349..f03eab91fd 100644
--- a/src/shared/btrfs-util.c
+++ b/src/shared/btrfs-util.c
@@ -1947,11 +1947,21 @@ static int btrfs_read_chunk_tree_fd(int fd, BtrfsChunkTree *ret) {
                         if (sh.type != BTRFS_CHUNK_ITEM_KEY)
                                 continue;
 
+                        if (sh.len < sizeof(struct btrfs_chunk))
+                                return -EBADMSG;
+
                         chunk = new(BtrfsChunk, 1);
                         if (!chunk)
                                 return -ENOMEM;
 
                         const struct btrfs_chunk *item = body;
+
+                        if (le16toh(item->num_stripes) == 0 || le64toh(item->stripe_len) == 0)
+                                return -EBADMSG;
+
+                        if ((sh.len - sizeof(struct btrfs_chunk)) / sizeof(struct btrfs_stripe) + 1 < le16toh(item->num_stripes))
+                                return -EBADMSG;
+
                         *chunk = (BtrfsChunk) {
                                 .offset = sh.offset,
                                 .length = le64toh(item->length),