[lsan][fuchsia] Add extra check for allocator cache to avoid overflow

[leonardchan]

Summary

Prior to this, we would check if the end of the allocator cache was located before the end of the chunk passed to the tls check. However, if the actual allocator cache comes after the end of the chunk, then the sub in the end - params->allocator_caches[i] bit overflows. Since the resulting type is an unsigned uptr, this is not UB, but if the signed result would be a negative value (ie. end < params->allocator_caches[i]) then this will actually result in a very large unsigned value much bigger than the compared sizeof(AllocatorCache) which will almost always be true. This can cause ScanRangeForPointers to accept incorrect values: a begin pointing to some address, and params->allocator_caches[i] pointing to some much larger address way past the end of the chunk which can result in a page fault/stack overflow.

[phosek]

LGTM

compiler-rt/lib/lsan/lsan_common_fuchsia.cpp

void LockStuffAndStopTheWorld(StopTheWorldCallback callback,
   // variables as well as C11 tss_set and POSIX pthread_setspecific.
   auto tls = +[](void *chunk, size_t size, void *data) {
     auto params = static_cast<const Params *>(data);
     uptr begin = reinterpret_cast<uptr>(chunk);
     uptr end = begin + size;
     auto i = __sanitizer::InternalLowerBound(params->allocator_caches, begin);
     if (i < params->allocator_caches.size() &&
         params->allocator_caches[i] >= begin &&
+        params->allocator_caches[i] <= end &&
         end - params->allocator_caches[i] >= sizeof(AllocatorCache)) {
       // Split the range in two and omit the allocator cache within.
       ScanRangeForPointers(begin, params->allocator_caches[i],
                            &params->argument->frontier, "TLS", kReachable);
       uptr begin2 = params->allocator_caches[i] + sizeof(AllocatorCache);
       ScanRangeForPointers(begin2, end, &params->argument->frontier, "TLS",
                            kReachable);
     } else {