l2cap: Verify number of channels in the CoC request

If remote side sends request for more than 5 channels, Android shall
reject it.

Bug: 232256974
Test: atest BluetoothInstrumentationTests
Change-Id: I85b8d8358123b1713d5c6d0c4251352a7de8fa8a
(cherry picked from commit d24b9c262039347b30c1ec41d38fa5c598a9fbd7)
Merged-In: I85b8d8358123b1713d5c6d0c4251352a7de8fa8a
diff --git a/stack/l2cap/l2c_ble.cc b/stack/l2cap/l2c_ble.cc
index d548679..c878ef2 100644
--- a/stack/l2cap/l2c_ble.cc
+++ b/stack/l2cap/l2c_ble.cc
@@ -26,6 +26,7 @@
 
 #include <base/logging.h>
 #include <base/strings/stringprintf.h>
+#include <log/log.h>
 
 #include "bt_target.h"
 #include "bta_hearing_aid_api.h"
@@ -515,6 +516,15 @@
 
       /* Check how many channels remote side wants. */
       num_of_channels = (p_pkt_end - p) / sizeof(uint16_t);
+      if (num_of_channels > L2CAP_CREDIT_BASED_MAX_CIDS) {
+        android_errorWriteLog(0x534e4554, "232256974");
+        LOG_WARN("L2CAP - invalid number of channels requested: %d",
+                 num_of_channels);
+        l2cu_reject_credit_based_conn_req(p_lcb, id,
+                                          L2CAP_CREDIT_BASED_MAX_CIDS,
+                                          L2CAP_LE_RESULT_INVALID_PARAMETERS);
+        return;
+      }
 
       LOG_DEBUG(
           "Recv L2CAP_CMD_CREDIT_BASED_CONN_REQ with "