diff
- if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) {
-   memcpy(build_label, edl->data + 1, build_lbl_len);
+ if (build_lbl_len > 0 && build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) {
+   memcpy(build_label, edl->data + 1, build_lbl_len);
+   build_label[build_lbl_len] = '\0';
+ } else {
+   bt_dev_err(hdev, "Invalid build label length: %d", build_lbl_len);
+   err = -EINVAL;
+   goto out;
+ }
