diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 9719965672e5..ae4e1db8f41f 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -19208,6 +19208,11 @@ static QDF_STATUS extract_pdev_utf_event_tlv(wmi_unified_t wmi_handle, param_buf = (WMI_PDEV_UTF_EVENTID_param_tlvs *)evt_buf; event->data = param_buf->data; event->datalen = param_buf->num_data; + + if (event->datalen < sizeof(struct wmi_host_utf_seg_header_info)) { + WMI_LOGE("%s: Invalid datalen: %d ", __func__, event->datalen); + return QDF_STATUS_E_INVAL; + } seg_hdr = (struct wmi_host_utf_seg_header_info *)param_buf->data; /* Set pdev_id=1 until FW adds support to include pdev_id */ event->pdev_id = wmi_handle->ops->convert_pdev_id_target_to_host(