diff options
| -rw-r--r-- | wmi/src/wmi_unified_tlv.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 3bab35be205e..f221b3b415c4 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -4209,6 +4209,12 @@ static QDF_STATUS extract_sar_limit_event_tlv(wmi_unified_t wmi_handle, event->sar_enable = fixed_param->sar_enable; event->num_limit_rows = fixed_param->num_limit_rows; + if (event->num_limit_rows > param_buf->num_sar_get_limits) { + WMI_LOGE(FL("Num rows %d exceeds sar_get_limits rows len %d"), + event->num_limit_rows, param_buf->num_sar_get_limits); + return QDF_STATUS_E_INVAL; + } + if (event->num_limit_rows > MAX_SAR_LIMIT_ROWS_SUPPORTED) { QDF_ASSERT(0); WMI_LOGE(FL("Num rows %d exceeds max of %d"), |