Merge "mtp: avoid silent allocation overflow in MtpProperty"

#define LOG_TAG "MtpProperty"

#include <inttypes.h>

#include <cutils/compiler.h>

#include "MtpDataPacket.h"

#include "MtpDebug.h"

#include "MtpProperty.h"

MtpPropertyValue* MtpProperty::readArrayValues(MtpDataPacket& packet, int& length) {

    length = packet.getUInt32();

    if (length == 0)

    // Fail if resulting array is over 2GB.  This is because the maximum array

    // size may be less than SIZE_MAX on some platforms.

    if ( CC_UNLIKELY(

            length == 0 ||

            length >= INT32_MAX / sizeof(MtpPropertyValue)) ) {

        length = 0;

        return NULL;

    }

    MtpPropertyValue* result = new MtpPropertyValue[length];

    for (int i = 0; i < length; i++)

        readValue(packet, result[i]);