diff --git a/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c index 465426e4395..04d41d3e7d7 100644 --- a/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c +++ b/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c @@ -293,6 +293,11 @@ static int ptt_sock_rx_nlink_msg (struct sk_buff * skb) wnl = (tAniNlHdr *) skb->data; radio = wnl->radio; type = wnl->nlh.nlmsg_type; + + if (wnl->nlh.nlmsg_len < (sizeof(struct nlmsghdr) + + sizeof(int) + sizeof(tAniHdr) + wnl->wmsg.length)) + return -EINVAL; + switch (type) { case ANI_NL_MSG_PUMAC: //Message from the PTT socket APP PTT_TRACE(VOS_TRACE_LEVEL_INFO, "%s: Received ANI_NL_MSG_PUMAC Msg [0x%X]\n",