diff --git a/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c b/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c index a7d4df8fa24..21e807ba0ac 100644 --- a/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c +++ b/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDeauthFrame.c @@ -68,15 +68,19 @@ limProcessDeauthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession p tpDphHashNode pStaDs; tpPESession pRoamSessionEntry=NULL; tANI_U8 roamSessionId; -#ifdef WLAN_FEATURE_11W tANI_U32 frameLen; -#endif - pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo); pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo); + frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); + if (frameLen < sizeof(reasonCode)) { + PELOGE(limLog(pMac, LOGE, + FL("received invalid framelen %d"), frameLen);) + return; + } + if ((eLIM_STA_ROLE == psessionEntry->limSystemRole) && (eLIM_SME_WT_DEAUTH_STATE == psessionEntry->limSmeState)) { @@ -122,7 +126,6 @@ limProcessDeauthFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession p PELOGE(limLog(pMac, LOGE, FL("received an unprotected deauth from AP"));) // If the frame received is unprotected, forward it to the supplicant to initiate // an SA query - frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); //send the unprotected frame indication to SME limSendSmeUnprotectedMgmtFrameInd( pMac, pHdr->fc.subType,