diff options
| -rw-r--r-- | CORE/MAC/src/pe/lim/limProcessDisassocFrame.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c b/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c index 805ad5f0c..1985c21d7 100644 --- a/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c +++ b/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2017, 2019 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -80,12 +80,16 @@ limProcessDisassocFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession tpSirMacMgmtHdr pHdr; tpDphHashNode pStaDs; tLimMlmDisassocInd mlmDisassocInd; -#ifdef WLAN_FEATURE_11W - tANI_U32 frameLen; -#endif + tANI_U32 frame_len; pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo); pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo); + frame_len = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); + + if (frame_len < 2) { + limLog(pMac, LOGE, FL("frame len less than 2")); + return; + } if (limIsGroupAddr(pHdr->sa)) { @@ -124,10 +128,9 @@ limProcessDisassocFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo, tpPESession PELOGE(limLog(pMac, LOG1, FL("received an unprotected disassoc from AP"));) // If the frame received is unprotected, forward it to the supplicant to initiate // an SA query - frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); //send the unprotected frame indication to SME limSendSmeUnprotectedMgmtFrameInd( pMac, pHdr->fc.subType, - (tANI_U8*)pHdr, (frameLen + sizeof(tSirMacMgmtHdr)), + (tANI_U8*)pHdr, (frame_len + sizeof(tSirMacMgmtHdr)), psessionEntry->smeSessionId, psessionEntry); return; } |