--- zzzz-none-000/linux-4.4.60/drivers/bluetooth/ath3k.c	2017-04-08 07:53:53.000000000 +0000
+++ scorpion-1750e-727/linux-4.4.60/drivers/bluetooth/ath3k.c	2021-02-04 17:41:59.000000000 +0000
@@ -209,13 +209,27 @@
 {
 	u8 *send_buf;
 	int err, pipe, len, size, sent = 0;
-	int count = firmware->size;
+	int count;
 
 	BT_DBG("udev %p", udev);
 
+	if (!firmware || !firmware->data || firmware->size <= 0) {
+		err = -EINVAL;
+		BT_ERR("Not a valid FW file");
+		return err;
+	}
+
+	count = firmware->size;
+
+	if (count < FW_HDR_SIZE) {
+		err = -EINVAL;
+		BT_ERR("ath3k loading invalid size of file");
+		return err;
+	}
+
 	pipe = usb_sndctrlpipe(udev, 0);
 
-	send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
+	send_buf = kzalloc(BULK_SIZE, GFP_KERNEL);
 	if (!send_buf) {
 		BT_ERR("Can't allocate memory chunk for firmware");
 		return -ENOMEM;