{
        PRT_HIGH_THROUGHPUT     pHTInfo = ieee->pHTInfo;
        PRX_REORDER_ENTRY       pReorderEntry = NULL;
-       struct ieee80211_rxb *prxbIndicateArray[REORDER_WIN_SIZE];
+       struct ieee80211_rxb **prxbIndicateArray;
        u8                      WinSize = pHTInfo->RxReorderWinSize;
        u16                     WinEnd = (pTS->RxIndicateSeq + WinSize -1)%4096;
        u8                      index = 0;
        bool                    bMatchWinStart = false, bPktInBuf = false;
        IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): Seq is %d,pTS->RxIndicateSeq is %d, WinSize is %d\n",__func__,SeqNum,pTS->RxIndicateSeq,WinSize);
+
+       prxbIndicateArray = kmalloc(sizeof(struct ieee80211_rxb *) *
+                       REORDER_WIN_SIZE, GFP_KERNEL);
+       if (!prxbIndicateArray)
+               return;
+
        /* Rx Reorder initialize condition.*/
        if (pTS->RxIndicateSeq == 0xffff) {
                pTS->RxIndicateSeq = SeqNum;
                        kfree(prxb);
                        prxb = NULL;
                }
+
+               kfree(prxbIndicateArray);
                return;
        }
 
                // Indicate packets
                if(index>REORDER_WIN_SIZE){
                        IEEE80211_DEBUG(IEEE80211_DL_ERR, "RxReorderIndicatePacket(): Rx Reorer buffer full!! \n");
+                       kfree(prxbIndicateArray);
                        return;
                }
                ieee80211_indicate_packets(ieee, prxbIndicateArray, index);
                pTS->RxPktPendingTimer.expires = jiffies + MSECS(pHTInfo->RxReorderPendingTime);
                add_timer(&pTS->RxPktPendingTimer);
        }
+
+       kfree(prxbIndicateArray);
 }
 
 static u8 parse_subframe(struct sk_buff *skb,