Fix an OOB bug in on_iso_link_quality_read

Bug: 260568750
Test: manual
Tag: #security
Ignore-AOSP-First: security
Merged-In: I58b259541a507d65271c4e8b61fcd878a3f90ec0
Change-Id: I58b259541a507d65271c4e8b61fcd878a3f90ec0

system/stack/btm/btm_iso_impl.h

@@ -353,6 +353,13 @@ struct iso_impl {
     uint32_t rxUnreceivedPackets;
     uint32_t duplicatePackets;
 
+    // 1 + 2 + 4 * 7
+#define ISO_LINK_QUALITY_SIZE 31
+    if (len < ISO_LINK_QUALITY_SIZE) {
+      LOG(ERROR) << "Malformated link quality format, len=" << len;
+      return;
+    }
+
     STREAM_TO_UINT8(status, stream);
     if (status != HCI_SUCCESS) {
       LOG(ERROR) << "Failed to Read ISO Link Quality, status: "