Code: status_t MediaPlayer::setDataSource(
 const sp<IMediaHTTPService> &httpService,
 const char *url, const KeyedVector<String8, String8> *headers)
{

     ALOGV("setDataSource(%s)", url);
     status_t err = BAD_VALUE;
     if (url != NULL) {
        const sp<IMediaPlayerService>& service(getMediaPlayerService());
         if (service != 0) {
             sp<IMediaPlayer> player(service->create(this, mAudioSessionId));
             if ((NO_ERROR != doSetRetransmitEndpoint(player)) ||
 (NO_ERROR != player->setDataSource(httpService, url, headers))) {
                player.clear();
 }
            err = attachNewPlayer(player);
 }
 }
 return err;
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-476
Summary: libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference or memory corruption) via a crafted media file, aka internal bug 28166152.
Commit Message: Don't use sp<>&

because they may end up pointing to NULL after a NULL check was performed.

Bug: 28166152
Change-Id: Iab2ea30395b620628cc6f3d067dd4f6fcda824fe
