~hc/RK356X_SDK_RELEASE.git

..	..	@@ -502,6 +502,11 @@
502	502	struct iwl_mcc_update_resp mcc_resp = (void )pkt->data;
503	503
504	504	n_channels = __le32_to_cpu(mcc_resp->n_channels);
	505	+ if (iwl_rx_packet_payload_len(pkt) !=
	506	+ struct_size(mcc_resp, channels, n_channels)) {
	507	+ resp_cp = ERR_PTR(-EINVAL);
	508	+ goto exit;
	509	+ }
505	510	resp_len = sizeof(struct iwl_mcc_update_resp) +
506	511	n_channels * sizeof(__le32);
507	512	resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL);
..	..	@@ -513,6 +518,11 @@
513	518	struct iwl_mcc_update_resp_v3 mcc_resp_v3 = (void )pkt->data;
514	519
515	520	n_channels = __le32_to_cpu(mcc_resp_v3->n_channels);
	521	+ if (iwl_rx_packet_payload_len(pkt) !=
	522	+ struct_size(mcc_resp_v3, channels, n_channels)) {
	523	+ resp_cp = ERR_PTR(-EINVAL);
	524	+ goto exit;
	525	+ }
516	526	resp_len = sizeof(struct iwl_mcc_update_resp) +
517	527	n_channels * sizeof(__le32);
518	528	resp_cp = kzalloc(resp_len, GFP_KERNEL);