Code:  bool Cues::Find(long long time_ns, const Track* pTrack, const CuePoint*& pCP,
                 const CuePoint::TrackPosition*& pTP) const {
  assert(time_ns >= 0);
  assert(pTrack);
#if 0
    LoadCuePoint();  //establish invariant
    assert(m_cue_points);
    assert(m_count > 0);
    CuePoint** const ii = m_cue_points;
    CuePoint** i = ii;
    CuePoint** const jj = ii + m_count + m_preload_count;
    CuePoint** j = jj;
    pCP = *i;
    assert(pCP);
    if (time_ns <= pCP->GetTime(m_pSegment))
    {
        pTP = pCP->Find(pTrack);
        return (pTP != NULL);
    }
    IMkvReader* const pReader = m_pSegment->m_pReader;
    while (i < j)
    {
        CuePoint** const k = i + (j - i) / 2;
        assert(k < jj);
        CuePoint* const pCP = *k;
        assert(pCP);
        pCP->Load(pReader);
        const long long t = pCP->GetTime(m_pSegment);
        if (t <= time_ns)
            i = k + 1;
        else
            j = k;
        assert(i <= j);
    }
    assert(i == j);
    assert(i <= jj);
    assert(i > ii);
    pCP = *--i;
    assert(pCP);
    assert(pCP->GetTime(m_pSegment) <= time_ns);
#else
  if (m_cue_points == NULL)
    return false;
  if (m_count == 0)
     return false;
 
   CuePoint** const ii = m_cue_points;
 CuePoint** i = ii;

 CuePoint** const jj = ii + m_count;

   CuePoint** j = jj;
 
   pCP = *i;
  assert(pCP);
 
   if (time_ns <= pCP->GetTime(m_pSegment)) {
     pTP = pCP->Find(pTrack);
 return (pTP != NULL);
 }

 while (i < j) {

 
     CuePoint** const k = i + (j - i) / 2;
    assert(k < jj);
 
     CuePoint* const pCP = *k;
    assert(pCP);
 
     const long long t = pCP->GetTime(m_pSegment);
 
 if (t <= time_ns)
      i = k + 1;

     else
       j = k;
 
    assert(i <= j);
   }
 
  assert(i == j);
  assert(i <= jj);
  assert(i > ii);
 
   pCP = *--i;
  assert(pCP);
  assert(pCP->GetTime(m_pSegment) <= time_ns);
#endif
 

  pTP = pCP->Find(pTrack);

   return (pTP != NULL);
 }

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
