Merge "Fix an OOB write bug in gatt_process_notification" into tm-dev am: 68569357

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/22697261



Change-Id: I659be20b850ae5ae04a88750098e9b2e467873a3
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

system/stack/gatt/gatt_cl.cc

@@ -758,6 +758,10 @@ void gatt_process_notification(tGATT_TCB& tcb, uint16_t cid, uint8_t op_code,
     // Make sure we don't read past the remaining data even if the length says
     // we can Also need to watch comparing the int16_t with the uint16_t
     value.len = std::min((uint16_t)rem_len, value.len);
+    if (value.len > sizeof(value.value)) {
+      LOG(ERROR) << "Unexpected value.len (>GATT_MAX_ATTR_LEN), stop";
+      return ;
+    }
     STREAM_TO_ARRAY(value.value, p, value.len);
     // Accounting
     rem_len -= value.len;