diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 1124421..61876eb 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -588,8 +588,10 @@
 			elems->cf_params_len = elen;
 			break;
 		case WLAN_EID_TIM:
-			elems->tim = pos;
-			elems->tim_len = elen;
+			if (elen >= sizeof(struct ieee80211_tim_ie)) {
+				elems->tim = (void *)pos;
+				elems->tim_len = elen;
+			}
 			break;
 		case WLAN_EID_IBSS_PARAMS:
 			elems->ibss_params = pos;