Code:  long long Segment::CreateInstance(IMkvReader* pReader, long long pos,
                                   Segment*& pSegment) {
  assert(pReader);
  assert(pos >= 0);
 
   pSegment = NULL;
 
 long long total, available;

 const long status = pReader->Length(&total, &available);

 if (status < 0) // error
 return status;

 if (available < 0)
 return -1;

 if ((total >= 0) && (available > total))
 return -1;


 for (;;) {
 if ((total >= 0) && (pos >= total))
 return E_FILE_FORMAT_INVALID;

 long len;
 long long result = GetUIntLength(pReader, pos, len);

 if (result) // error, or too few available bytes
 return result;

 if ((total >= 0) && ((pos + len) > total))
 return E_FILE_FORMAT_INVALID;

 if ((pos + len) > available)

       return pos + len;
 
     const long long idpos = pos;
    const long long id = ReadUInt(pReader, pos, len);
 
    if (id < 0)  // error
      return id;
 
     pos += len;  // consume ID
 

    result = GetUIntLength(pReader, pos, len);

 if (result) // error, or too few available bytes
 return result;

 if ((total >= 0) && ((pos + len) > total))
 return E_FILE_FORMAT_INVALID;

 if ((pos + len) > available)
 return pos + len;

 long long size = ReadUInt(pReader, pos, len);

 if (size < 0) // error
 return size;

    pos += len; // consume length of size of element


 const long long unknown_size = (1LL << (7 * len)) - 1;

 if (id == 0x08538067) { // Segment ID
 if (size == unknown_size)
        size = -1;

 else if (total < 0)
        size = -1;

 else if ((pos + size) > total)
        size = -1;

      pSegment = new (std::nothrow) Segment(pReader, idpos,
                                            pos, size);

 if (pSegment == 0)
 return -1; // generic error

 return 0; // success
 }

 if (size == unknown_size)
 return E_FILE_FORMAT_INVALID;

 if ((total >= 0) && ((pos + size) > total))
 return E_FILE_FORMAT_INVALID;

 if ((pos + size) > available)
 return pos + size;

    pos += size; // consume payload
 }
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
