Local privilege escalation via camera buffer integer overflow

An out-of-bounds write in Android kernel camera code allows local users to escalate privileges through an integer overflow. AllocateInternalBuffers in g3aa_buffer_allocator.cc lets an integer calculation overflow before writing internal camera buffers, producing an out-of-bounds write. A local user needs no additional execution privileges or user interaction to gain elevated privileges on an affected device.