Code: void RilSapSocket::sendDisconnect() {
 size_t encoded_size = 0;
 uint32_t written_size;
 size_t buffer_size = 0;
 pb_ostream_t ostream;
 bool success = false;

    RIL_SIM_SAP_DISCONNECT_REQ disconnectReq;


    if ((success = pb_get_encoded_size(&encoded_size, RIL_SIM_SAP_DISCONNECT_REQ_fields,
         &disconnectReq)) && encoded_size <= INT32_MAX) {
         buffer_size = encoded_size + sizeof(uint32_t);
        uint8_t buffer[buffer_size];
         written_size = htonl((uint32_t) encoded_size);
         ostream = pb_ostream_from_buffer(buffer, buffer_size);
         pb_write(&ostream, (uint8_t *)&written_size, sizeof(written_size));
        success = pb_encode(&ostream, RIL_SIM_SAP_DISCONNECT_REQ_fields, buffer);

 if(success) {
 pb_bytes_array_t *payload = (pb_bytes_array_t *)calloc(1,
 sizeof(pb_bytes_array_t) + written_size);
 if (!payload) {
                RLOGE("sendDisconnect: OOM");
 return;
 }
            memcpy(payload->bytes, buffer, written_size);
            payload->size = written_size;
 MsgHeader *hdr = (MsgHeader *)malloc(sizeof(MsgHeader));
 if (!hdr) {
                RLOGE("sendDisconnect: OOM");
                free(payload);
 return;
 }
            hdr->payload = payload;
            hdr->type = MsgType_REQUEST;
            hdr->id = MsgId_RIL_SIM_SAP_DISCONNECT;
            hdr->error = Error_RIL_E_SUCCESS;
            dispatchDisconnect(hdr);
 }

         else {
             RLOGE("Encode failed in send disconnect!");
         }
     }
 }

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: libril/RilSapSocket.cpp in Telephony in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 relies on variable-length arrays, which allows attackers to gain privileges via a crafted application, aka internal bug 30202619.
Commit Message: Replace variable-length arrays on stack with malloc.

Bug: 30202619
Change-Id: Ib95e08a1c009d88a4b4fd8d8fdba0641c6129008
(cherry picked from commit 943905bb9f99e3caa856b42c531e2be752da8834)
