diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 8ef971db229b..d443bb978eaa 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -5920,6 +5920,14 @@ static QDF_STATUS send_stats_ext_req_cmd_tlv(wmi_unified_t wmi_handle, wmi_buf_t buf; size_t len; uint8_t *buf_ptr; + uint16_t max_wmi_msg_size = wmi_get_max_msg_len(wmi_handle); + + if (preq->request_data_len > (max_wmi_msg_size - WMI_TLV_HDR_SIZE - + sizeof(*cmd))) { + wmi_err("Data length=%d is greater than max wmi msg size", + preq->request_data_len); + return QDF_STATUS_E_FAILURE; + } len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + preq->request_data_len;