Code: static bool getCoverageFormat12(vector<uint32_t>& coverage, const uint8_t* data, size_t size) {
 const size_t kNGroupsOffset = 12;
 const size_t kFirstGroupOffset = 16;
 const size_t kGroupSize = 12;
 const size_t kStartCharCodeOffset = 0;
 const size_t kEndCharCodeOffset = 4;
 const size_t kMaxNGroups = 0xfffffff0 / kGroupSize; // protection against overflow
 if (kFirstGroupOffset > size) {
 return false;
 }
 uint32_t nGroups = readU32(data, kNGroupsOffset);
 if (nGroups >= kMaxNGroups || kFirstGroupOffset + nGroups * kGroupSize > size) {
 return false;
 }
 for (uint32_t i = 0; i < nGroups; i++) {

         uint32_t groupOffset = kFirstGroupOffset + i * kGroupSize;
         uint32_t start = readU32(data, groupOffset + kStartCharCodeOffset);
         uint32_t end = readU32(data, groupOffset + kEndCharCodeOffset);
         addRange(coverage, start, end + 1);  // file is inclusive, vector is exclusive
     }
     return true;
}

Vulnerability Type: DoS Mem. Corr. 
CWE ID: CWE-20
Summary: The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size values in font data, which allows remote attackers to cause a denial of service (memory corruption and reboot loop) via a crafted font, aka internal bug 26413177.
Commit Message: Reject fonts with invalid ranges in cmap

A corrupt or malicious font may have a negative size in its cmap
range, which in turn could lead to memory corruption. This patch
detects the case and rejects the font, and also includes an assertion
in the sparse bit set implementation if we missed any such case.

External issue:
https://code.google.com/p/android/issues/detail?id=192618

Bug: 26413177
Change-Id: Icc0c80e4ef389abba0964495b89aa0fae3e9f4b2
