Code: int sysMapFile(const char* fn, MemMapping* pMap)
{
    memset(pMap, 0, sizeof(*pMap));

 if (fn && fn[0] == '@') {
 FILE* mapf = fopen(fn+1, "r");
 if (mapf == NULL) {
            LOGV("Unable to open '%s': %s\n", fn+1, strerror(errno));
 return -1;
 }

 
         if (sysMapBlockFile(mapf, pMap) != 0) {
             LOGW("Map of '%s' failed\n", fn);
             return -1;
         }
 
        fclose(mapf);
 } else {
 int fd = open(fn, O_RDONLY, 0);
 if (fd < 0) {
            LOGE("Unable to open '%s': %s\n", fn, strerror(errno));
 return -1;
 }

 if (sysMapFD(fd, pMap) != 0) {
            LOGE("Map of '%s' failed\n", fn);
            close(fd);
 return -1;
 }

        close(fd);
 }
 return 0;
}

Vulnerability Type: Overflow +Priv 
CWE ID: CWE-189
Summary: Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26960931.
Commit Message: Fix integer overflows in recovery procedure.

Bug: 26960931
Change-Id: Ieae45caccfb4728fcf514f0d920976585d8e6caf
(cherry picked from commit 4f2df162c6ab4a71ca86e4b38735b681729c353b)
