bt: check BT MTU before subtracting ATT overhead

Returned MTU can be 0 in case BT (or only ATT) connection is no longer
active. In that case subtracting would overflow unsigned number.

This fixes issue detected by Coverity Scan.

Signed-off-by: Marcin Niestroj <m.niestroj@emb.dev>

Author: mniestroj

lib/bt/downlink.c

@@ -199,7 +199,13 @@ struct pouch_gateway_downlink_context *pouch_gateway_downlink_start(struct bt_co
         return NULL;
     }
 
-    size_t mtu = bt_gatt_get_mtu(conn) - POUCH_GATEWAY_BT_ATT_OVERHEAD;
+    size_t mtu = bt_gatt_get_mtu(conn);
+    if (mtu < POUCH_GATEWAY_BT_ATT_OVERHEAD)
+    {
+        LOG_ERR("MTU too small");
+        return NULL;
+    }
+    mtu -= POUCH_GATEWAY_BT_ATT_OVERHEAD;
 
     node->downlink_ctx = pouch_gateway_downlink_open(downlink_data_available, conn);
     if (NULL == node->downlink_ctx)

lib/bt/server_cert.c

@@ -220,7 +220,15 @@ void pouch_gateway_server_cert_write(struct bt_conn *conn)
         return;
     }
 
-    size_t mtu = bt_gatt_get_mtu(conn) - POUCH_GATEWAY_BT_ATT_OVERHEAD;
+    size_t mtu = bt_gatt_get_mtu(conn);
+    if (mtu < POUCH_GATEWAY_BT_ATT_OVERHEAD)
+    {
+        LOG_ERR("MTU too small");
+        server_cert_cleanup(conn);
+        pouch_gateway_bt_finished(conn);
+        return;
+    }
+    mtu -= POUCH_GATEWAY_BT_ATT_OVERHEAD;
 
     node->server_cert_sender = pouch_gatt_sender_create(node->packetizer, send_data_cb, conn, mtu);
     if (NULL == node->server_cert_sender)