Changed the second overflow check to prevent integer overflows
@@ -439,7 +439,7 @@ input_l2cap_frame_flow_channel(l2cap_channel_t *channel, uint8_t *data, uint16_t
memcpy(&frame_len, &data[0], 2);
payload_len = frame_len;
- if(channel->rx_buffer.current_index + payload_len > BLE_L2CAP_NODE_MTU) {
+ if(payload_len > BLE_L2CAP_NODE_MTU - channel->rx_buffer.current_index) {
LOG_WARN("l2cap_frame: illegal L2CAP frame payload_len: %d\n", payload_len);
/* the current index plus the payload length may not be larger than
* the destination buffer */
