diff --git a/app/aboot/aboot.c b/app/aboot/aboot.c
index fb34b87..5ff06ca 100755
--- a/app/aboot/aboot.c
+++ b/app/aboot/aboot.c
@@ -1772,6 +1772,11 @@
 	/* Start processing chunks */
 	for (chunk=0; chunk<sparse_header->total_chunks; chunk++)
 	{
+		/* Make sure the total image size does not exceed the partition size */
+		if(((uint64_t)total_blocks * (uint64_t)sparse_header->blk_sz) >= size) {
+			fastboot_fail("size too large");
+			return;
+		}
 		/* Read and skip over chunk header */
 		chunk_header = (chunk_header_t *) data;
 		data += sizeof(chunk_header_t);
@@ -1790,6 +1795,23 @@
 		}
 
 		chunk_data_sz = sparse_header->blk_sz * chunk_header->chunk_sz;
+
+		/* Make sure multiplication does not overflow uint32 size */
+		if (sparse_header->blk_sz && (chunk_header->chunk_sz != chunk_data_sz / sparse_header->blk_sz))
+		{
+			fastboot_fail("Bogus size sparse and chunk header");
+			return;
+		}
+
+		/* Make sure that the chunk size calculated from sparse image does not
+		 * exceed partition size
+		 */
+		if ((uint64_t)total_blocks * (uint64_t)sparse_header->blk_sz + chunk_data_sz > size)
+		{
+			fastboot_fail("Chunk data size exceeds partition size");
+			return;
+		}
+
 		switch (chunk_header->chunk_type)
 		{
 			case CHUNK_TYPE_RAW:
@@ -1807,11 +1829,19 @@
 				fastboot_fail("flash write failure");
 				return;
 			}
+			if(total_blocks > (UINT_MAX - chunk_header->chunk_sz)) {
+				fastboot_fail("Bogus size for RAW chunk type");
+				return;
+			}
 			total_blocks += chunk_header->chunk_sz;
 			data += chunk_data_sz;
 			break;
 
 			case CHUNK_TYPE_DONT_CARE:
+			if(total_blocks > (UINT_MAX - chunk_header->chunk_sz)) {
+				fastboot_fail("bogus size for chunk DONT CARE type");
+				return;
+			}
 			total_blocks += chunk_header->chunk_sz;
 			break;
 
@@ -1821,6 +1851,10 @@
 				fastboot_fail("Bogus chunk size for chunk type Dont Care");
 				return;
 			}
+			if(total_blocks > (UINT_MAX - chunk_header->chunk_sz)) {
+				fastboot_fail("bogus size for chunk CRC type");
+				return;
+			}
 			total_blocks += chunk_header->chunk_sz;
 			data += chunk_data_sz;
 			break;