Code: static ssize_t get_node_path_locked(struct node* node, char* buf, size_t bufsize) {
 const char* name;
 size_t namelen;
 if (node->graft_path) {
        name = node->graft_path;
        namelen = node->graft_pathlen;
 } else if (node->actual_name) {
        name = node->actual_name;
        namelen = node->namelen;
 } else {
        name = node->name;
        namelen = node->namelen;
 }

 if (bufsize < namelen + 1) {
 return -1;
 }

 
     ssize_t pathlen = 0;
     if (node->parent && node->graft_path == NULL) {
        pathlen = get_node_path_locked(node->parent, buf, bufsize - namelen - 2);
         if (pathlen < 0) {
             return -1;
         }
        buf[pathlen++] = '/';
 }

    memcpy(buf + pathlen, name, namelen + 1); /* include trailing \0 */
 return pathlen + namelen;
}

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 28085658.
Commit Message: Fix overflow in path building

An incorrect size was causing an unsigned value
to wrap, causing it to write past the end of
the buffer.

Bug: 28085658
Change-Id: Ie9625c729cca024d514ba2880ff97209d435a165
