Code: long ContentEncoding::ParseContentEncodingEntry(long long start, long long size,
 IMkvReader* pReader) {
  assert(pReader);

 long long pos = start;
 const long long stop = start + size;

 int compression_count = 0;
 int encryption_count = 0;

 while (pos < stop) {
 long long id, size;
 const long status = ParseElementHeader(pReader, pos, stop, id, size);
 if (status < 0) // error
 return status;

 if (id == 0x1034) // ContentCompression ID
 ++compression_count;

 if (id == 0x1035) // ContentEncryption ID

       ++encryption_count;
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
   if (compression_count <= 0 && encryption_count <= 0)
 return -1;

 
   if (compression_count > 0) {
     compression_entries_ =
        new (std::nothrow) ContentCompression* [compression_count];
     if (!compression_entries_)
       return -1;
     compression_entries_end_ = compression_entries_;
 }

 
   if (encryption_count > 0) {
     encryption_entries_ =
        new (std::nothrow) ContentEncryption* [encryption_count];
     if (!encryption_entries_) {
       delete[] compression_entries_;
       return -1;
 }
    encryption_entries_end_ = encryption_entries_;
 }

  pos = start;
 while (pos < stop) {
 long long id, size;
 long status = ParseElementHeader(pReader, pos, stop, id, size);
 if (status < 0) // error
 return status;

 if (id == 0x1031) {
      encoding_order_ = UnserializeUInt(pReader, pos, size);
 } else if (id == 0x1032) {
      encoding_scope_ = UnserializeUInt(pReader, pos, size);
 if (encoding_scope_ < 1)
 return -1;
 } else if (id == 0x1033) {
      encoding_type_ = UnserializeUInt(pReader, pos, size);
 } else if (id == 0x1034) {
 ContentCompression* const compression =
 new (std::nothrow) ContentCompression();
 if (!compression)
 return -1;

      status = ParseCompressionEntry(pos, size, pReader, compression);
 if (status) {
 delete compression;
 return status;
 }
 *compression_entries_end_++ = compression;
 } else if (id == 0x1035) {
 ContentEncryption* const encryption =
 new (std::nothrow) ContentEncryption();
 if (!encryption)
 return -1;

      status = ParseEncryptionEntry(pos, size, pReader, encryption);
 if (status) {
 delete encryption;
 return status;
 }
 *encryption_entries_end_++ = encryption;

     }
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
  assert(pos == stop);
   return 0;
 }

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
