diff --git a/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c b/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c index 8def5f3a89f..dc8dd5a837b 100644 --- a/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c +++ b/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c @@ -742,6 +742,13 @@ void writeBeaconToMemory(tpAniSirGlobal pMac, tANI_U16 size, tANI_U16 length, tp // copy end of beacon only if length > 0 if (length > 0) { + if (size + pMac->sch.schObject.gSchBeaconOffsetEnd > + SCH_MAX_BEACON_SIZE) { + PELOGE(schLog(pMac, LOGE, + FL("beacon template fail size %d BeaconOffsetEnd %d"), + size, pMac->sch.schObject.gSchBeaconOffsetEnd);) + return; + } for (i=0; i < pMac->sch.schObject.gSchBeaconOffsetEnd; i++) pMac->sch.schObject.gSchBeaconFrameBegin[size++] = pMac->sch.schObject.gSchBeaconFrameEnd[i]; }