Local privilege escalation via Parcel size overflow

Out-of-bounds writes in Android 10 Parcel.cpp allow local users to elevate privileges in the system server without user interaction. The Binder and HwBinder Parcel implementations apply incorrect unsigned addition and multiplication overflow checks, allowing size arithmetic to wrap before bounds handling. A malicious local application can exploit the resulting memory corruption to execute with system-server privileges; no user interaction is required.