Fix overflow in path building

An incorrect size was causing an unsigned value
to wrap, causing it to write past the end of
the buffer.

Bug: 28085658
Change-Id: Ie9625c729cca024d514ba2880ff97209d435a165

static void handle_fuse_requests(struct fuse_handler* handler)
{
 struct fuse* fuse = handler->fuse;
 for (;;) {
 ssize_t len = TEMP_FAILURE_RETRY(read(fuse->fd,
                handler->request_buffer, sizeof(handler->request_buffer)));
 if (len < 0) {
 if (errno == ENODEV) {
                ERROR("[%d] someone stole our marbles!\n", handler->token);
                exit(2);
 }
            ERROR("[%d] handle_fuse_requests: errno=%d\n", handler->token, errno);
 continue;
 }

 if ((size_t)len < sizeof(struct fuse_in_header)) {
            ERROR("[%d] request too short: len=%zu\n", handler->token, (size_t)len);
 continue;
 }

 const struct fuse_in_header *hdr = (void*)handler->request_buffer;
 if (hdr->len != (size_t)len) {
            ERROR("[%d] malformed header: len=%zu, hdr->len=%u\n",
                    handler->token, (size_t)len, hdr->len);
 continue;
 }

 const void *data = handler->request_buffer + sizeof(struct fuse_in_header);
 size_t data_len = len - sizeof(struct fuse_in_header);
        __u64 unique = hdr->unique;
 int res = handle_fuse_request(fuse, handler, hdr, data, data_len);

 /* We do not access the request again after this point because the underlying
         * buffer storage may have been reused while processing the request. */

 if (res != NO_STATUS) {
 if (res) {
                TRACE("[%d] ERROR %d\n", handler->token, res);
 }
            fuse_status(fuse, unique, res);
 }
 }
}

static void handle_fuse_requests(struct fuse_handler* handler)
{
 struct fuse* fuse = handler->fuse;
 for (;;) {
 ssize_t len = TEMP_FAILURE_RETRY(read(fuse->fd,
                handler->request_buffer, sizeof(handler->request_buffer)));
 if (len < 0) {
 if (errno == ENODEV) {
                ERROR("[%d] someone stole our marbles!\n", handler->token);
                exit(2);
 }
            ERROR("[%d] handle_fuse_requests: errno=%d\n", handler->token, errno);
 continue;
 }

 if ((size_t)len < sizeof(struct fuse_in_header)) {
            ERROR("[%d] request too short: len=%zu\n", handler->token, (size_t)len);
 continue;
 }

 const struct fuse_in_header *hdr = (void*)handler->request_buffer;
 if (hdr->len != (size_t)len) {
            ERROR("[%d] malformed header: len=%zu, hdr->len=%u\n",
                    handler->token, (size_t)len, hdr->len);
 continue;
 }

 const void *data = handler->request_buffer + sizeof(struct fuse_in_header);
 size_t data_len = len - sizeof(struct fuse_in_header);
        __u64 unique = hdr->unique;
 int res = handle_fuse_request(fuse, handler, hdr, data, data_len);

 /* We do not access the request again after this point because the underlying
         * buffer storage may have been reused while processing the request. */

 if (res != NO_STATUS) {
 if (res) {
                TRACE("[%d] ERROR %d\n", handler->token, res);
 }
            fuse_status(fuse, unique, res);
 }
 }
}
