Code: static int sysMapFD(int fd, MemMapping* pMap)
{
 off_t start;
 size_t length;
 void* memPtr;

    assert(pMap != NULL);

 if (getFileStartAndLength(fd, &start, &length) < 0)
 return -1;

    memPtr = mmap(NULL, length, PROT_READ, MAP_PRIVATE, fd, start);
 if (memPtr == MAP_FAILED) {
        LOGW("mmap(%d, R, PRIVATE, %d, %d) failed: %s\n", (int) length,
            fd, (int) start, strerror(errno));
 return -1;
 }

    pMap->addr = memPtr;

     pMap->length = length;
     pMap->range_count = 1;
     pMap->ranges = malloc(sizeof(MappedRange));
     pMap->ranges[0].addr = memPtr;
     pMap->ranges[0].length = length;
 
 return 0;
}

Vulnerability Type: Overflow +Priv 
CWE ID: CWE-189
Summary: Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26960931.
Commit Message: Fix integer overflows in recovery procedure.

Bug: 26960931
Change-Id: Ieae45caccfb4728fcf514f0d920976585d8e6caf
(cherry picked from commit 4f2df162c6ab4a71ca86e4b38735b681729c353b)
