Add a missing bounds check.

Bug: 21888473
Change-Id: Iafd7e6dbb3d7a36ad9dbad279e501fdfb26f812a
diff --git a/include/keymaster/serializable.h b/include/keymaster/serializable.h
index a7cce83..6dd31b2 100644
--- a/include/keymaster/serializable.h
+++ b/include/keymaster/serializable.h
@@ -173,7 +173,7 @@
         return false;
 
     const uint8_t* array_end = *buf_ptr + *count * sizeof(uint32_t);
-    if (array_end < *buf_ptr || array_end > end)
+    if (*count >= UINT32_MAX / sizeof(uint32_t) || array_end < *buf_ptr || array_end > end)
         return false;
 
     data->reset(new (std::nothrow) T[*count]);