diff --git a/components/bt/host/bluedroid/stack/gatt/gatt_db.c b/components/bt/host/bluedroid/stack/gatt/gatt_db.c
index 8844ef5dc8e..6c578e678f1 100644
--- a/components/bt/host/bluedroid/stack/gatt/gatt_db.c
+++ b/components/bt/host/bluedroid/stack/gatt/gatt_db.c
@@ -1039,20 +1039,23 @@ tGATT_STATUS gatts_write_attr_value_by_handle(tGATT_SVC_DB *p_db,
                     return GATT_APP_RSP;
                 }
 
-                if ((p_attr->p_value != NULL) &&
-                    (p_attr->p_value->attr_val.attr_max_len >= offset + len) &&
-                    p_attr->p_value->attr_val.attr_val != NULL) {
-                    memcpy(p_attr->p_value->attr_val.attr_val + offset, p_value, len);
-                    p_attr->p_value->attr_val.attr_len = len + offset;
-                    return GATT_SUCCESS;
-                } else if (p_attr->p_value && p_attr->p_value->attr_val.attr_max_len < offset + len){
-                    GATT_TRACE_DEBUG("Remote device try to write with a length larger then attribute's max length\n");
-                    return GATT_INVALID_ATTR_LEN;
-                } else if ((p_attr->p_value == NULL) || (p_attr->p_value->attr_val.attr_val == NULL)){
+                if (p_attr->p_value == NULL || p_attr->p_value->attr_val.attr_val == NULL) {
                     GATT_TRACE_ERROR("Error in %s, line=%d, %s should not be NULL here\n", __func__, __LINE__, \
                                     (p_attr->p_value == NULL) ? "p_value" : "attr_val.attr_val");
                     return GATT_UNKNOWN_ERROR;
                 }
+
+                /* Check for integer overflow: offset + len must not overflow UINT16
+                 * and must not exceed attr_max_len */
+                if (offset > p_attr->p_value->attr_val.attr_max_len ||
+                    len > p_attr->p_value->attr_val.attr_max_len - offset) {
+                    GATT_TRACE_DEBUG("Remote device try to write with a length larger than attribute's max length\n");
+                    return GATT_INVALID_ATTR_LEN;
+                }
+
+                memcpy(p_attr->p_value->attr_val.attr_val + offset, p_value, len);
+                p_attr->p_value->attr_val.attr_len = offset + len;
+                return GATT_SUCCESS;
             }
 
             p_attr = (tGATT_ATTR16 *)p_attr->p_next;