diff options
| -rw-r--r-- | wmi/src/wmi_unified_tlv.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 346879f9865b..95286ee66ad4 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -13027,6 +13027,12 @@ static host_mem_req *extract_host_mem_req_tlv(wmi_unified_t wmi_handle, return NULL; } + if (ev->num_mem_reqs > param_buf->num_mem_reqs) { + WMI_LOGE("Invalid num_mem_reqs %d:%d", + ev->num_mem_reqs, param_buf->num_mem_reqs); + return NULL; + } + *num_entries = ev->num_mem_reqs; return (host_mem_req *)param_buf->mem_reqs; |