Code:  native_handle_t* native_handle_create(int numFds, int numInts)
 {
    native_handle_t* h = malloc(
            sizeof(native_handle_t) + sizeof(int)*(numFds+numInts));
 
     if (h) {
         h->version = sizeof(native_handle_t);
         h->numFds = numFds;
        h->numInts = numInts;
 }
 return h;
}

Vulnerability Type: DoS Overflow Mem. Corr. 
CWE ID: CWE-189
Summary: Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.
Commit Message: Prevent integer overflow when allocating native_handle_t

User specified values of numInts and numFds can overflow
and cause malloc to allocate less than we expect, causing
heap corruption in subsequent operations on the allocation.

Bug: 19334482
Change-Id: I43c75f536ea4c08f14ca12ca6288660fd2d1ec55
