diff --git a/core/hdd/inc/wlan_hdd_wext.h b/core/hdd/inc/wlan_hdd_wext.h index 4bb3a6c8c299..158b88a0277a 100644 --- a/core/hdd/inc/wlan_hdd_wext.h +++ b/core/hdd/inc/wlan_hdd_wext.h @@ -153,7 +153,7 @@ enum hdd_wlan_wmm_ts_info_ack_policy { }; /** Maximum Length of WPA/RSN IE */ -#define MAX_WPA_RSN_IE_LEN 40 +#define MAX_WPA_RSN_IE_LEN 255 /** Enable 11d */ #define ENABLE_11D 1 diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index afa959484196..f9d59062014b 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -16889,6 +16889,11 @@ static int wlan_hdd_cfg80211_set_ie(struct hdd_adapter *adapter, break; case DOT11F_EID_RSN: hdd_debug("Set RSN IE(len %d)", eLen + 2); + if (eLen > (MAX_WPA_RSN_IE_LEN - 2)) { + hdd_err("%s: Invalid WPA RSN IE length[%d]", + __func__, eLen); + return -EINVAL; + } memset(pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN); memcpy(pWextState->WPARSNIE, genie - 2, (eLen + 2));