On Fri, 2021-08-20 at 08:20 -0400, Wen Gong wrote: > > + case WLAN_EID_TX_POWER_ENVELOPE: > + if (elems->tx_pwr_env_num >= ARRAY_SIZE(elems->tx_pwr_env) || > + elen < 1) > + break; IMHO this should also check the max length, but I'll fix that. johannes