Code: long ParseElementHeader(IMkvReader* pReader, long long& pos,
 long long stop, long long& id,
 long long& size) {
 if (stop >= 0 && pos >= stop)
 return E_FILE_FORMAT_INVALID;

 long len;

  id = ReadID(pReader, pos, len);

 if (id < 0)
 return E_FILE_FORMAT_INVALID;

  pos += len; // consume id

 if (stop >= 0 && pos >= stop)
 return E_FILE_FORMAT_INVALID;

  size = ReadUInt(pReader, pos, len);

 if (size < 0 || len < 1 || len > 8) {
 return E_FILE_FORMAT_INVALID;
 }

 const unsigned long long rollover_check =
 static_cast<unsigned long long>(pos) + len;
 if (rollover_check > LONG_LONG_MAX)
 return E_FILE_FORMAT_INVALID;

  pos += len; // consume length of size

 
 
  if (stop >= 0 && pos >= stop)
     return E_FILE_FORMAT_INVALID;
 
   return 0;  // success
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: Fix ParseElementHeader to support 0 payload elements

Cherry-pick'ing Change 5c83bbec9a5f6f00a349674ddad85b753d2ea219
from upstream. This fixes regression in some edge cases for mkv
playback.

BUG=26499283

Change-Id: I88de03219a3d941b6b2f251d384e29c36bdd4d9b
