diff options
| -rw-r--r-- | CORE/MAC/src/pe/lim/limProcessActionFrame.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/CORE/MAC/src/pe/lim/limProcessActionFrame.c index ae31f9d90acc..0e0440310903 100644 --- a/CORE/MAC/src/pe/lim/limProcessActionFrame.c +++ b/CORE/MAC/src/pe/lim/limProcessActionFrame.c @@ -1888,6 +1888,12 @@ limProcessActionFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,tpPESession ps pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo); frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); + if (frameLen < sizeof(pPubAction)) { + limLog(pMac, LOG1, + FL("Received action frame of invalid len %d"), frameLen); + break; + } + //Check if it is a P2P public action frame. if (vos_mem_compare(pPubAction->Oui, P2POui, 4)) { @@ -2068,6 +2074,12 @@ limProcessActionFrameNoSession(tpAniSirGlobal pMac, tANI_U8 *pBd) pHdr = WDA_GET_RX_MAC_HEADER(pBd); frameLen = WDA_GET_RX_PAYLOAD_LEN(pBd); + if (frameLen < sizeof(pActionHdr)) { + limLog(pMac, LOG1, + FL("Received action frame of invalid len %d"), frameLen); + break; + } + //Check if it is a P2P public action frame. if (vos_mem_compare(pActionHdr->Oui, P2POui, 4)) { |