Code: std::string utf16ToUtf8(const StringPiece16& utf16) {
 ssize_t utf8Length = utf16_to_utf8_length(utf16.data(), utf16.length());
 if (utf8Length <= 0) {
 return {};

     }
 
     std::string utf8;
     utf8.resize(utf8Length);
    utf16_to_utf8(utf16.data(), utf16.length(), &*utf8.begin());
     return utf8;
 }

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.
Commit Message: Add bound checks to utf16_to_utf8

Test: ran libaapt2_tests64
Bug: 29250543
Change-Id: I1ebc017af623b6514cf0c493e8cd8e1d59ea26c3
(cherry picked from commit 4781057e78f63e0e99af109cebf3b6a78f4bfbb6)
