Code: void utf16_to_utf8(const char16_t* src, size_t src_len, char* dst)
 {
     if (src == NULL || src_len == 0 || dst == NULL) {
         return;
 }

 const char16_t* cur_utf16 = src;
 const char16_t* const end_utf16 = src + src_len;
 char *cur = dst;
 while (cur_utf16 < end_utf16) {
 char32_t utf32;
 if((*cur_utf16 & 0xFC00) == 0xD800 && (cur_utf16 + 1) < end_utf16
 && (*(cur_utf16 + 1) & 0xFC00) == 0xDC00) {
            utf32 = (*cur_utf16++ - 0xD800) << 10;
            utf32 |= *cur_utf16++ - 0xDC00;
            utf32 += 0x10000;
 } else {

             utf32 = (char32_t) *cur_utf16++;
         }
         const size_t len = utf32_codepoint_utf8_length(utf32);
         utf32_codepoint_to_utf8((uint8_t*)cur, utf32, len);
         cur += len;
     }
     *cur = '\0';
 }

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.
Commit Message: libutils/Unicode.cpp: Correct length computation and add checks for utf16->utf8

Inconsistent behaviour between utf16_to_utf8 and utf16_to_utf8_length
is causing a heap overflow.

Correcting the length computation and adding bound checks to the
conversion functions.

Test: ran libutils_tests
Bug: 29250543
Change-Id: I6115e3357141ed245c63c6eb25fc0fd0a9a7a2bb
(cherry picked from commit c4966a363e46d2e1074d1a365e232af0dcedd6a1)
