--- a/techpack/audio/dsp/rtac.c
+++ b/techpack/audio/dsp/rtac.c
@@ -652,6 +652,12 @@
 	pr_debug("%s\n", __func__);
 
 	mutex_lock(&rtac_voice_mutex);
+	if (rtac_voice_data.num_of_voice_combos > ARRAY_SIZE(rtac_voice_data.voice)) {
+		pr_err("%s: invalid voice count %u\n", __func__,
+		       rtac_voice_data.num_of_voice_combos);
+		mutex_unlock(&rtac_voice_mutex);
+		return;
+	}
 	/* look for device */
 	for (i = 0; i < rtac_voice_data.num_of_voice_combos; i++) {
 		if (rtac_voice_data.voice[i].cvs_handle == cvs_handle) {
--- a/drivers/staging/qcacld-3.0/core/mac/src/pe/lim/lim_process_fils.c
+++ b/drivers/staging/qcacld-3.0/core/mac/src/pe/lim/lim_process_fils.c
@@ -1092,6 +1092,9 @@
 		return false;
 	}
 
+	if (dot11f_ie_rsn.pmkid_count > ARRAY_SIZE(dot11f_ie_rsn.pmkid))
+		return false;
+
 	for (i = 0; i < dot11f_ie_rsn.pmkid_count; i++) {
 		if (qdf_mem_cmp(dot11f_ie_rsn.pmkid[i],
 		    pe_session->fils_info->fils_pmkid,