Code: static char* allocFromUTF16(const char16_t* in, size_t len)

 {
     if (len == 0) return getEmptyString();
 
    const ssize_t bytes = utf16_to_utf8_length(in, len);
    if (bytes < 0) {
         return getEmptyString();
     }
 
    SharedBuffer* buf = SharedBuffer::alloc(bytes+1);
     ALOG_ASSERT(buf, "Unable to allocate shared buffer");
     if (!buf) {
         return getEmptyString();
     }
 
    char* str = (char*)buf->data();
    utf16_to_utf8(in, len, str);
    return str;
 }

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.
Commit Message: libutils/Unicode.cpp: Correct length computation and add checks for utf16->utf8

Inconsistent behaviour between utf16_to_utf8 and utf16_to_utf8_length
is causing a heap overflow.

Correcting the length computation and adding bound checks to the
conversion functions.

Test: ran libutils_tests
Bug: 29250543
Change-Id: I6115e3357141ed245c63c6eb25fc0fd0a9a7a2bb
(cherry picked from commit c4966a363e46d2e1074d1a365e232af0dcedd6a1)
