diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c index 6d7ca4679076..8b6a073ea59e 100644 --- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c @@ -511,7 +511,7 @@ void lim_send_sme_start_bss_rsp(struct mac_context *mac, uint16_t size = 0; struct scheduler_msg mmhMsg = {0}; struct start_bss_rsp *pSirSmeRsp; - uint16_t ieLen; + uint16_t beacon_length, ieLen; uint16_t ieOffset, curLen; pe_debug("Sending message: %s with reasonCode: %s", @@ -526,8 +526,13 @@ void lim_send_sme_start_bss_rsp(struct mac_context *mac, } else { /* subtract size of beaconLength + Mac Hdr + Fixed Fields before SSID */ ieOffset = sizeof(tAniBeaconStruct) + SIR_MAC_B_PR_SSID_OFFSET; - ieLen = pe_session->schBeaconOffsetBegin - + pe_session->schBeaconOffsetEnd - ieOffset; + beacon_length = pe_session->schBeaconOffsetBegin + + pe_session->schBeaconOffsetEnd; + ieLen = beacon_length - ieOffset; + + /* Invalidate for non-beaconing entities */ + if (beacon_length <= ieOffset) + ieLen = ieOffset = 0; /* calculate the memory size to allocate */ size += ieLen; diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c index 46781b2be076..54762ec7de29 100644 --- a/core/sme/src/csr/csr_util.c +++ b/core/sme/src/csr/csr_util.c @@ -1418,9 +1418,16 @@ QDF_STATUS csr_parse_bss_description_ies(struct mac_context *mac_ctx, tDot11fBeaconIEs *pIEStruct) { QDF_STATUS status = QDF_STATUS_E_FAILURE; - int ieLen = - (int)(bss_desc->length + sizeof(bss_desc->length) - - GET_FIELD_OFFSET(struct bss_description, ieFields)); + uint16_t ieFields_offset; + int ieLen; + + ieFields_offset = GET_FIELD_OFFSET(struct bss_description, ieFields); + if (!bss_desc->length || + (bss_desc->length - sizeof(bss_desc->length) <= ieFields_offset)) + return status; + + ieLen = (int)(bss_desc->length + sizeof(bss_desc->length) - + ieFields_offset); if (ieLen > 0 && pIEStruct) { if (!DOT11F_FAILED(dot11f_unpack_beacon_i_es