From fc8d244eaeea78615f956c4d7433d9d2faf2c5b5 Mon Sep 17 00:00:00 2001
From: Shreeyash <shreeyash.bhakare@espressif.com>
Date: Tue, 17 Dec 2024 16:28:41 +0530
Subject: [PATCH] fix(nimble): Added a check for invalid offset

---
 nimble/host/src/ble_gattc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nimble/host/src/ble_gattc.c b/nimble/host/src/ble_gattc.c
index 3b30a01ca..e8ba32fbe 100644
--- a/nimble/host/src/ble_gattc.c
+++ b/nimble/host/src/ble_gattc.c
@@ -4173,6 +4173,11 @@ ble_gattc_write_long(uint16_t conn_handle, uint16_t attr_handle,
     /* The mbuf is consumed by the procedure. */
     txom = NULL;
 
+    if (proc->write_long.attr.offset > OS_MBUF_PKTLEN(proc->write_long.attr.om)) {
+        rc = BLE_ATT_ERR_INVALID_OFFSET;
+        goto done;
+    }
+
     ble_gattc_log_write_long(proc);
 
     rc = ble_gattc_write_long_tx(proc);