diff
+ static inline int safe_memcpy(void *dest, const void *src, size_t n, size_t dest_size)
+ {
+     if (n > dest_size)
+         return -EOVERFLOW;
+     memcpy(dest, src, n);
+     return 0;
+ }
  ...
- memcpy(data, fw->data, size);
+ if (safe_memcpy(data, fw->data, size, size) < 0) {
+     bt_dev_err(hdev, "Firmware size exceeds allocated buffer");
+     vfree(data);
+     return -EINVAL;
+ }
