diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index 881da74e4afa..6c81b8e8e2d6 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -1259,7 +1259,7 @@ int wma_nan_rsp_event_handler(void *handle, uint8_t *event_buf, alloc_len = sizeof(tSirNanEvent); alloc_len += nan_rsp_event_hdr->data_len; if (nan_rsp_event_hdr->data_len > ((WMI_SVC_MSG_MAX_SIZE - - sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t)) || + WMI_TLV_HDR_SIZE - sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t)) || nan_rsp_event_hdr->data_len > param_buf->num_data) { WMA_LOGE("excess data length:%d, num_data:%d", nan_rsp_event_hdr->data_len, param_buf->num_data);