Local buffer overflow via negative write length

Integer overflow in the VR service on Qualcomm Snapdragon platforms allows local users to trigger a buffer overflow via write requests. The service fails to reject a negative data length when processing a write request, allowing the value to drive an integer overflow and subsequent buffer overflow. Local access is required, while authentication and user interaction are not; Qualcomm does not disclose the overflow's exact runtime consequence.