diff --git a/core/mac/src/pe/sch/sch_beacon_gen.c b/core/mac/src/pe/sch/sch_beacon_gen.c index df3023b200..87a1c304d0 100644 --- a/core/mac/src/pe/sch/sch_beacon_gen.c +++ b/core/mac/src/pe/sch/sch_beacon_gen.c @@ -933,6 +933,12 @@ static QDF_STATUS write_beacon_to_memory(struct mac_context *mac, uint16_t size, /* copy end of beacon only if length > 0 */ if (length > 0) { + if (size + pe_session->schBeaconOffsetEnd > + SIR_MAX_BEACON_SIZE) { + pe_err("beacon tmp fail size %d BeaconOffsetEnd %d", + size, pe_session->schBeaconOffsetEnd); + return QDF_STATUS_E_FAILURE; + } for (i = 0; i < pe_session->schBeaconOffsetEnd; i++) pe_session->pSchBeaconFrameBegin[size++] = pe_session->pSchBeaconFrameEnd[i];