Prevent integer overflow in body-range for mention rendering.

app/src/main/java/org/thoughtcrime/securesms/database/MentionUtil.java

@@ -131,7 +131,7 @@ public final class MentionUtil {
     int start  = mention.getStart();
     int length = mention.getLength();
 
-    return start < 0 || length < 0 || (start + length) > body.length();
+    return start < 0 || length < 0 || ((long) start + length) > body.length();
   }
 
   public static class UpdatedBodyAndMentions {

app/src/main/java/org/thoughtcrime/securesms/notifications/v2/NotificationItem.kt

@@ -193,9 +193,14 @@ sealed class NotificationItem(val threadRecipient: Recipient, protected val reco
 
     if (spoilerRanges?.isNotEmpty() == true) {
       for (spoiler in spoilerRanges) {
+        val startIndex = spoiler.start.coerceAtMost(updatedText.length - 1).coerceAtLeast(0)
+        val endIndex = (spoiler.start.toLong() + spoiler.length)
+          .coerceIn(0L, updatedText.length.toLong())
+          .toInt()
+          .coerceAtLeast(startIndex)
         updatedText = updatedText.replaceRange(
-          startIndex = spoiler.start.coerceAtMost(updatedText.length - 1).coerceAtLeast(0),
-          endIndex = (spoiler.start + spoiler.length).coerceAtMost(updatedText.length).coerceAtLeast(0),
+          startIndex = startIndex,
+          endIndex = endIndex,
           replacement = "■■■■"
         )
       }

app/src/test/java/org/thoughtcrime/securesms/database/MentionUtilTest.kt

@@ -45,4 +45,13 @@ class MentionUtilTest {
 
     assertThat(update.body.toString()).isEqualTo("RecipientId::1est")
   }
+
+  @Test
+  fun overflowingRangeIsIgnored() {
+    val mentions = listOf(Mention(RecipientId.from(1L), 1, Int.MAX_VALUE))
+
+    val update: MentionUtil.UpdatedBodyAndMentions = MentionUtil.update("hi there", mentions) { it.recipientId.toString() }
+
+    assertThat(update.body.toString()).isEqualTo("hi there")
+  }
 }