diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 8fac470063c3..e8b0b8ccb428 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2341,6 +2341,15 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev, if (!mbssid_elem) break; + /* + * The max_bssid_indicator field is mandatory, therefore the + * length of the MBSSID element should atleast be 1. + */ + if (!mbssid_elem[TAG_LEN_POS]) { + scm_debug_rl("MBSSID IE is of length zero"); + break; + } + mbssid_info.profile_count = (1 << mbssid_elem[MBSSID_INDICATOR_POS]);