diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index ed0b297341c4..e37b06f7eec4 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -14083,13 +14083,21 @@ static int __wlan_hdd_cfg80211_add_key(struct wiphy *wiphy, return -EINVAL; } - hdd_debug("called with key index = %d & key length %d", key_index, params->key_len); + if (CSR_MAX_RSC_LEN < params->seq_len) { + hdd_err("Invalid seq length %d", params->seq_len); + + return -EINVAL; + } + + hdd_debug("key index %d, key length %d, seq length %d", + key_index, params->key_len, params->seq_len); /*extract key idx, key len and key */ qdf_mem_zero(&setKey, sizeof(tCsrRoamSetKey)); setKey.keyId = key_index; setKey.keyLength = params->key_len; qdf_mem_copy(&setKey.Key[0], params->key, params->key_len); + qdf_mem_copy(&setKey.keyRsc[0], params->seq, params->seq_len); switch (params->cipher) { case WLAN_CIPHER_SUITE_WEP40: