libbinder: Parcel: grow rejects large data pos

This is unexpected behavior so throw an error.
Allocating this much memory may cause OOM or
other issues.

Bug: 370831157
Test: fuzzer
(cherry picked from commit 608524d462278c2c9f6716cd94f126c85e9f2e91)
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:94e777ab39848540f9ef9d47229338d8996709d6)
Merged-In: Iea0884ca61b08e52e6a6e9c66693e427cb5536f4
Change-Id: Iea0884ca61b08e52e6a6e9c66693e427cb5536f4

libs/binder/Parcel.cpp

diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 564f81e..544b53c 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -2942,6 +2942,14 @@
         return BAD_VALUE;
     }
 
+    if (mDataPos > mDataSize) {
+        // b/370831157 - this case used to abort. We also don't expect mDataPos < mDataSize, but
+        // this would only waste a bit of memory, so it's okay.
+        ALOGE("growData only expected at the end of a Parcel. pos: %zu, size: %zu, capacity: %zu",
+              mDataPos, len, mDataCapacity);
+        return BAD_VALUE;
+    }
+
     if (len > SIZE_MAX - mDataSize) return NO_MEMORY; // overflow
     if (mDataSize + len > SIZE_MAX / 3) return NO_MEMORY; // overflow
     size_t newSize = ((mDataSize+len)*3)/2;