diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index aba535da18ca..d6d2687720b5 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -8582,11 +8582,18 @@ void hdd_indicate_mgmt_frame(tSirSmeMgmtFrameInd *frame_ind) struct hdd_context *hdd_ctx = NULL; struct hdd_adapter *adapter = NULL; int i; + struct ieee80211_mgmt *mgmt = + (struct ieee80211_mgmt *)frame_ind->frameBuf; hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD); if (wlan_hdd_validate_context(hdd_ctx)) return; + if (frame_ind->frame_len < ieee80211_hdrlen(mgmt->frame_control)) { + hdd_err(" Invalid frame length"); + return; + } + if (SME_SESSION_ID_ANY == frame_ind->sessionId) { for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) { adapter =