diff --git a/ChangeLog b/ChangeLog
index 572ee50d1..067606578 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2014-09-08  Michael Chang  <mchang@suse.com>
+
+	* grub-core/fs/btrfs.c (grub_btrfs_extent_read): Fix extent size
+	check; comparing &data->extent against addresses in the region it
+	points to is unpredictable.
+
 2014-09-07  Colin Watson  <cjwatson@ubuntu.com>
 
 	Support grub-emu on x32 (ILP32 but with x86-64 instruction set)
diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
index f7b6c1520..95a8fa6b3 100644
--- a/grub-core/fs/btrfs.c
+++ b/grub-core/fs/btrfs.c
@@ -1051,7 +1051,7 @@ grub_btrfs_extent_read (struct grub_btrfs_data *data,
 
 	  data->extend = data->extstart + grub_le_to_cpu64 (data->extent->size);
 	  if (data->extent->type == GRUB_BTRFS_EXTENT_REGULAR
-	      && (char *) &data->extent + elemsize
+	      && (char *) data->extent + elemsize
 	      >= (char *) &data->extent->filled + sizeof (data->extent->filled))
 	    data->extend =
 	      data->extstart + grub_le_to_cpu64 (data->extent->filled);