diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index b6930ed806..acb129cd4f 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -8967,6 +8967,15 @@ static int wlan_hdd_set_filter(hdd_context_t *hdd_ctx, request->params_data[i].data_length; packetFilterSetReq.paramsData[i].reserved = 0; + if (request->params_data[i].data_offset > + SIR_MAX_FILTER_TEST_DATA_OFFSET) { + hdd_err("Invalid data offset %u for param %d (max = %d)", + request->params_data[i].data_offset, + i, + SIR_MAX_FILTER_TEST_DATA_OFFSET); + return -EINVAL; + } + if (request->params_data[i].data_length > SIR_MAX_FILTER_TEST_DATA_LEN) { hdd_err("Error invalid data length %d", diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h index 56fd9d5213..3f671a8e6a 100644 --- a/core/mac/inc/sir_api.h +++ b/core/mac/inc/sir_api.h @@ -3083,6 +3083,7 @@ typedef struct sSirRoamOffloadScanRsp { Packet Filtering Parameters ---------------------------------------------------------------------------*/ #define SIR_MAX_FILTER_TEST_DATA_LEN 8 +#define SIR_MAX_FILTER_TEST_DATA_OFFSET 200 #define SIR_MAX_NUM_MULTICAST_ADDRESS 240 #define SIR_MAX_NUM_FILTERS 20 #define SIR_MAX_NUM_TESTS_PER_FILTER 10