diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h
index 3747bd2a8c5c..86c1dc097065 100644
--- a/core/mac/src/include/dot11f.h
+++ b/core/mac/src/include/dot11f.h
@@ -35,7 +35,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Thu Dec  7 00:22:18 2017 from the following file(s):
+ * Wed Dec 13 10:10:49 2017 from the following file(s):
  *
  * dot11f.frms
  *
diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
index f3eeafe0e506..3758d2f5fe96 100644
--- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c
+++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
@@ -33,7 +33,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Thu Dec  7 00:22:18 2017 from the following file(s):
+ * Wed Dec 13 10:10:49 2017 from the following file(s):
  *
  * dot11f.frms
  *
@@ -340,7 +340,7 @@ static uint32_t get_container_ies_len(tpAniSirGlobal pCtx,
 	pBufRemaining += len + 2;
 	len += 2;
 	while (len < nBuf) {
-		pIe = find_ie_defn(pCtx, pBufRemaining, nBuf + len, IEs);
+		pIe = find_ie_defn(pCtx, pBufRemaining, nBuf - len, IEs);
 		if (NULL == pIe)
 			break;
 		if (pIe->eid == pIeFirst->eid)
@@ -349,7 +349,7 @@ static uint32_t get_container_ies_len(tpAniSirGlobal pCtx,
 		pBufRemaining += *(pBufRemaining + 1) + 2;
 	}
 
-	if (len > 0xFF)
+	if ((len > 0xFF) || (len > nBuf))
 		return DOT11F_INTERNAL_ERROR;
 	*pnConsumed = len;
 	return DOT11F_PARSE_SUCCESS;
@@ -10571,11 +10571,15 @@ static uint32_t unpack_core(tpAniSirGlobal pCtx,
 		}
 
 		if (pIe) {
-			if (nBufRemaining < pIe->minSize - pIe->noui - 2U) {
-				FRAMES_LOG3(pCtx, FRLOGW, FRFL("The IE %s must be "
-					"at least %d bytes in size, but there are onl"
-					"y %d bytes remaining in this frame.\n"),
-					pIe->name, pIe->minSize, nBufRemaining);
+			if ((nBufRemaining < pIe->minSize - pIe->noui - 2U) ||
+			    (len < pIe->minSize - pIe->noui - 2U)) {
+				FRAMES_LOG4(pCtx, FRLOGW, FRFL("The IE %s must "
+					"be at least %d bytes in size, but "
+					"there are only %d bytes remaining in "
+					"this frame or the IE reports a size "
+					"of %d bytes.\n"),
+					pIe->name, pIe->minSize, nBufRemaining,
+					(len + pIe->noui + 2U));
 				FRAMES_DUMP(pCtx, FRLOG1, pBuf, nBuf);
 				status |= DOT11F_INCOMPLETE_IE;
 				FRAMES_DBG_BREAK();