Merge cherrypicks of [16816453, 17570067] into sc-d2-release.android-12.1.0_r26android-12.1.0_r25android-12.1.0_r24android-12.1.0_r23android-12.1.0_r18android-12.1.0_r17android-12.1.0_r13android-12.1.0_r12android12L-d2-s8-releaseandroid12L-d2-s7-releaseandroid12L-d2-s6-releaseandroid12L-d2-s5-releaseandroid12L-d2-s1-releaseandroid12L-d2-release

Change-Id: Iea54cbabb16aa09e085485ad87d344008ffe5a6f

2 files changed, 4 insertions, 1 deletions

diff --git a/stack/gatt/gatt_sr.cc b/stack/gatt/gatt_sr.cc
index 9fe642cba..0396bb16f 100644
--- a/stack/gatt/gatt_sr.cc
+++ b/stack/gatt/gatt_sr.cc
@@ -173,6 +173,9 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {
 
     if (p_rsp != NULL) {
       total_len = (p_buf->len + p_rsp->attr_value.len);
+      if (p_cmd->multi_req.variable_len) {
+        total_len += 2;
+      }
 
       if (total_len > mtu) {
         /* just send the partial response for the overflow case */
diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc
index 16454a5b0..d5486794d 100644
--- a/stack/l2cap/l2c_ble.cc
+++ b/stack/l2cap/l2c_ble.cc
@@ -621,7 +621,7 @@ void l2cble_process_sig_cmd(tL2C_LCB* p_lcb, uint8_t* p, uint16_t pkt_len) {
       break;
     }
     case L2CAP_CMD_CREDIT_BASED_CONN_RES:
-      if (p + 2 > p_pkt_end) {
+      if (p + 8 > p_pkt_end) {
         LOG(ERROR) << "invalid L2CAP_CMD_CREDIT_BASED_CONN_RES len";
         return;
       }