diff
+ static int safe_copy(char *dest, const char *src, size_t dest_size, size_t src_size) {
+ 	if (src_size >= dest_size) return -EOVERFLOW;
+ 	memcpy(dest, src, src_size);
+ 	dest[src_size] = '\0';
+ 	return 0;
+ }

35 	build_lbl_len = edl->data[0];
36 	if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) {
- 		memcpy(build_label, edl->data + 1, build_lbl_len);
+ 		if (safe_copy(build_label, (char *)edl->data + 1, QCA_FW_BUILD_VER_LEN, build_lbl_len) < 0) {
+ 			bt_dev_err(hdev, "Build label copy failed");
+ 			err = -EINVAL;
+ 			goto out;
+ 		}
