--- a/sys/dev/netif/iwi/if_iwi.c
+++ b/sys/dev/netif/iwi/if_iwi.c
@@ -2443,6 +2443,11 @@
 	DELAY(1000);
 
 	/* write microcode into adapter memory */
+	if (size & 1) {
+		device_printf(sc->sc_dev,
+		    "ucode image '%s' has odd size %zu", fw->name, size);
+		return EIO;
+	}
 	for (w = (const uint16_t *)uc; size > 0; w++, size -= 2)
 		MEM_WRITE_2(sc, 0x200010, htole16(*w));
 
@@ -2504,8 +2509,20 @@
 	CSR_WRITE_4(sc, IWI_CSR_AUTOINC_ADDR, 0x27000);
 
 	while (p < end) {
+		if (end - p < 8) {
+			device_printf(sc->sc_dev,
+			    "truncated command block header in %s firmware",
+			    fw->name);
+			return EIO;
+		}
 		dst = GETLE32(p); p += 4; src += 4;
 		len = GETLE32(p); p += 4; src += 4;
+		if (end - p < len) {
+			device_printf(sc->sc_dev,
+			    "command block length %u runs past %s firmware",
+			    len, fw->name);
+			return EIO;
+		}
 		p += len;
 
 		while (len > 0) {