No checks of buffer size in l2cap_chan_le_recv

[villytiger]

Describe the bug

zephyr/subsys/bluetooth/host/l2cap.c

Line 2192 in 80ec938

sdu_len = net_buf_pull_le16(buf);

static void l2cap_chan_le_recv(struct bt_l2cap_le_chan *chan,
			       struct net_buf *buf)
{
	uint16_t sdu_len;
	int err;

	if (!test_and_dec(&chan->rx.credits)) {
		BT_ERR("No credits to receive packet");
		bt_l2cap_chan_disconnect(&chan->chan);
		return;
	}

	/* Check if segments already exist */
	if (chan->_sdu) {
		l2cap_chan_le_recv_seg(chan, buf);
		return;
	}

	sdu_len = net_buf_pull_le16(buf);

May be I'm missing something. But it looks like net_buf_pull_le16 can read outside of the buffer if a frame has the length fewer than 2. I couldn't find any checks in the callers as well.

[jhedberg]

@villytiger seems like a valid issue. I created #32588 to try to fix it.