diff options
| -rw-r--r-- | CORE/CLD_TXRX/HTT/htt_t2h.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/CORE/CLD_TXRX/HTT/htt_t2h.c b/CORE/CLD_TXRX/HTT/htt_t2h.c index 7f2b7290a6bf..0653d3797b62 100644 --- a/CORE/CLD_TXRX/HTT/htt_t2h.c +++ b/CORE/CLD_TXRX/HTT/htt_t2h.c @@ -535,6 +535,7 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg ) u_int16_t peer_cnt = HTT_PEER_RATE_REPORT_MSG_PEER_COUNT_GET(*msg_word); u_int16_t i; struct rate_report_t *report, *each; + int max_peers; /* Param sanity check */ if (peer_cnt == 0) { @@ -542,6 +543,13 @@ htt_t2h_lp_msg_handler(void *context, adf_nbuf_t htt_t2h_msg ) break; } + max_peers = ol_cfg_max_peer_id(pdev->ctrl_pdev) + 1; + if (peer_cnt > max_peers) { + adf_os_print("RATE REPORT msg peer_cnt is larger than %d\n", + max_peers); + break; + } + /* At least one peer and no limit apply to peer_cnt here */ report = adf_os_mem_alloc(NULL, sizeof(struct rate_report_t) * peer_cnt); |