Code: bool ATSParser::PSISection::isCRCOkay() const {
 if (!isComplete()) {
 return false;
 }
 uint8_t* data = mBuffer->data();

 if ((data[1] & 0x80) == 0) {
 return true;
 }


     unsigned sectionLength = U16_AT(data + 1) & 0xfff;
     ALOGV("sectionLength %u, skip %u", sectionLength, mSkipBytes);
 
     sectionLength -= mSkipBytes;
 
 uint32_t crc = 0xffffffff;
 for(unsigned i = 0; i < sectionLength + 4 /* crc */; i++) {
 uint8_t b = data[i];
 int index = ((crc >> 24) ^ (b & 0xff)) & 0xff;
        crc = CRC_TABLE[index] ^ (crc << 8);
 }
    ALOGV("crc: %08x\n", crc);
 return (crc == 0);
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: mpeg2ts/ATSParser.cpp in libstagefright in mediaserver in Android 6.x before 2016-07-01 does not validate a certain section length, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28333006.
Commit Message: Check section size when verifying CRC

Bug: 28333006
Change-Id: Ief7a2da848face78f0edde21e2f2009316076679
