diff
1 static esp_err_t process_segment_data(intptr_t load_addr, uint32_t data_addr, uint32_t data_len, bool do_load, bootloader_sha256_handle_t sha_handle, uint32_t *checksum) {
+   const uint32_t MAX_DATA_SIZE = /* maximum allowed data size */;
+   if (data_len > MAX_DATA_SIZE) {
+       return ESP_ERR_INVALID_SIZE;
+   }
    // ... rest of the function ...
}
