Code: status_t GraphicBuffer::unflatten(
 void const*& buffer, size_t& size, int const*& fds, size_t& count) {
 if (size < 8*sizeof(int)) return NO_MEMORY;

 int const* buf = static_cast<int const*>(buffer);
 if (buf[0] != 'GBFR') return BAD_TYPE;


     const size_t numFds  = buf[8];
     const size_t numInts = buf[9];
 
     const size_t sizeNeeded = (10 + numInts) * sizeof(int);
     if (size < sizeNeeded) return NO_MEMORY;
 
    size_t fdCountNeeded = 0;
     if (count < fdCountNeeded) return NO_MEMORY;
 
     if (handle) {
        free_handle();
 }

 if (numFds || numInts) {
        width  = buf[1];
        height = buf[2];
        stride = buf[3];

         format = buf[4];
         usage  = buf[5];
         native_handle* h = native_handle_create(numFds, numInts);
         memcpy(h->data,          fds,     numFds*sizeof(int));
         memcpy(h->data + numFds, &buf[10], numInts*sizeof(int));
         handle = h;
 } else {
        width = height = stride = format = usage = 0;
        handle = NULL;
 }

    mId = static_cast<uint64_t>(buf[6]) << 32;
    mId |= static_cast<uint32_t>(buf[7]);

    mOwner = ownHandle;

 if (handle != 0) {
 status_t err = mBufferMapper.registerBuffer(handle);
 if (err != NO_ERROR) {
            width = height = stride = format = usage = 0;
            handle = NULL;
            ALOGE("unflatten: registerBuffer failed: %s (%d)",
                    strerror(-err), err);
 return err;
 }
 }

    buffer = reinterpret_cast<void const*>(static_cast<int const*>(buffer) + sizeNeeded);
    size -= sizeNeeded;
    fds += numFds;
    count -= numFds;

 return NO_ERROR;
}

Vulnerability Type: DoS Overflow +Priv Mem. Corr. 
CWE ID: CWE-189
Summary: Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.
Commit Message: Fix for corruption when numFds or numInts is too large.

Bug: 18076253
Change-Id: I4c5935440013fc755e1d123049290383f4659fb6
(cherry picked from commit dfd06b89a4b77fc75eb85a3c1c700da3621c0118)
