diff --git a/qcwcn/wifi_hal/wifilogger_diag.cpp b/qcwcn/wifi_hal/wifilogger_diag.cpp
index 5e9227b..d131102 100644
--- a/qcwcn/wifi_hal/wifilogger_diag.cpp
+++ b/qcwcn/wifi_hal/wifilogger_diag.cpp
@@ -2251,6 +2251,7 @@
         }
     } else if (cmd == ANI_NL_MSG_CNSS_DIAG) {
         uint16_t diag_fw_type;
+        struct nlmsghdr *nlh = nlmsg_hdr(msg);
 
         if (!info->cldctx) {
             buf = (uint8_t *)NLMSG_DATA(wnl) + sizeof(wnl->clh.radio);
@@ -2268,6 +2269,12 @@
                       wnl->nlh.nlmsg_len);
                 return WIFI_ERROR_UNKNOWN;
             }
+        } else {
+            if (nlh->nlmsg_len <= NLMSG_HDRLEN + sizeof(dbglog_slot)) {
+                ALOGE("Received CNSS_DIAG message with insufficent length: %d: %s:%d",
+                      nlh->nlmsg_len, __FUNCTION__, __LINE__);
+                return WIFI_ERROR_UNKNOWN;
+            }
         }
         diag_fw_type = event_hdr->diag_type;
         if (diag_fw_type == DIAG_TYPE_FW_MSG) {
@@ -2275,6 +2282,16 @@
             u16 length = 0;
 
             slot = (dbglog_slot *)buf;
+            if (nlh->nlmsg_len < (NLMSG_HDRLEN + sizeof(dbglog_slot) +
+                                        slot->length)) {
+                ALOGE("Received CNSS_DIAG message with insufficent length: %d:"
+                              " expected: %zu, %s:%d",
+                      nlh->nlmsg_len,
+                      (NLMSG_HDRLEN + sizeof(dbglog_slot) +slot->length),
+                      __FUNCTION__,
+                      __LINE__);
+                return WIFI_ERROR_UNKNOWN;
+            }
             length = get_le32((u8 *)&slot->length);
             process_fw_diag_msg(info, &slot->payload[0], length);
         }