Local privilege escalation via encoder size overflow

An out-of-bounds write in Petteri Aimonen Nanopb allows local users with System privileges to gain elevated access on Android. The pb_write function adds count to bytes_written without first detecting integer wraparound, allowing an untrusted bytes.size value to bypass max_size and drive reads and writes beyond the buffer. Exploitation requires code already running with Android System privileges and a build where size_t equals pb_size_t; no user interaction is required.