diff --git a/core/mac/src/pe/lim/lim_process_auth_frame.c b/core/mac/src/pe/lim/lim_process_auth_frame.c index 5138b40786..ee8adb30f2 100644 --- a/core/mac/src/pe/lim/lim_process_auth_frame.c +++ b/core/mac/src/pe/lim/lim_process_auth_frame.c @@ -465,7 +465,7 @@ static void lim_process_sae_auth_frame(struct mac_context *mac_ctx, if (LIM_IS_STA_ROLE(pe_session)) { auth_algo = *(uint16_t *)body_ptr; - if (frame_len > (SAE_AUTH_STATUS_CODE_OFFSET + 2)) { + if (frame_len >= (SAE_AUTH_STATUS_CODE_OFFSET + 2)) { sae_auth_seq = *(uint16_t *)(body_ptr + SAE_AUTH_SEQ_NUM_OFFSET); @@ -1702,7 +1702,7 @@ bool lim_process_sae_preauth_frame(struct mac_context *mac, uint8_t *rx_pkt) if (auth_alg != eSIR_AUTH_TYPE_SAE) return false; - if (frm_len > (SAE_AUTH_STATUS_CODE_OFFSET + 2)) { + if (frm_len >= (SAE_AUTH_STATUS_CODE_OFFSET + 2)) { sae_auth_seq = *(uint16_t *)(frm_body + SAE_AUTH_SEQ_NUM_OFFSET); sae_status_code =