Code: static bool getCoverageFormat12(vector<uint32_t>& coverage, const uint8_t* data, size_t size) {
 const size_t kNGroupsOffset = 12;
 const size_t kFirstGroupOffset = 16;
 const size_t kGroupSize = 12;
 const size_t kStartCharCodeOffset = 0;
 const size_t kEndCharCodeOffset = 4;
 const size_t kMaxNGroups = 0xfffffff0 / kGroupSize; // protection against overflow
 if (kFirstGroupOffset > size) {
 return false;

     }
     uint32_t nGroups = readU32(data, kNGroupsOffset);
     if (nGroups >= kMaxNGroups || kFirstGroupOffset + nGroups * kGroupSize > size) {
         return false;
     }
     for (uint32_t i = 0; i < nGroups; i++) {
 uint32_t groupOffset = kFirstGroupOffset + i * kGroupSize;
 uint32_t start = readU32(data, groupOffset + kStartCharCodeOffset);

         uint32_t end = readU32(data, groupOffset + kEndCharCodeOffset);
         if (end < start) {
             return false;
         }
         addRange(coverage, start, end + 1);  // file is inclusive, vector is exclusive
 }
 return true;
}

Vulnerability Type: DoS Mem. Corr. 
CWE ID: CWE-20
Summary: The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size values in font data, which allows remote attackers to cause a denial of service (memory corruption and reboot loop) via a crafted font, aka internal bug 26413177.
Commit Message: Add error logging on invalid cmap - DO NOT MERGE

This patch logs instances of fonts with invalid cmap tables.

Bug: 25645298
Bug: 26413177
Change-Id: I183985e9784a97a2b4307a22e036382b1fc90e5e
