libbinder: keep ashmem size >= 0

Avoid integer overflow.

Bug: 123590642
Test: device boots
Change-Id: I9f25827842da00c4e69efca849c6a94721964007
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index b2db945..0423264 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -181,7 +181,10 @@
                 if ((outAshmemSize != nullptr) && ashmem_valid(obj.handle)) {
                     int size = ashmem_get_size_region(obj.handle);
                     if (size > 0) {
-                        *outAshmemSize -= size;
+                        // ashmem size might have changed since last time it was accounted for, e.g.
+                        // in acquire_object(). Value of *outAshmemSize is not critical since we are
+                        // releasing the object anyway. Check for integer overflow condition.
+                        *outAshmemSize -= std::min(*outAshmemSize, static_cast<size_t>(size));
                     }
                 }