There’s an integer overflow issue in get_node_path_locked in /system/bin/sdcard on Android, which results in a buffer overflow.