Code: long Segment::ParseCues(
    long long off,
    long long& pos,
    long& len)
{
    if (m_pCues)
        return 0;  //success
 
    if (off < 0)
        return -1;
 
    long long total, avail;
 
    const int status = m_pReader->Length(&total, &avail);
 
    if (status < 0)  //error
        return status;
 
    assert((total < 0) || (avail <= total));
 
    pos = m_start + off;
 
    if ((total < 0) || (pos >= total))
        return 1;  //don't bother parsing cues
 
    const long long element_start = pos;
    const long long segment_stop = (m_size < 0) ? -1 : m_start + m_size;
 
    if ((pos + 1) > avail)
    {
        len = 1;
        return E_BUFFER_NOT_FULL;
    }
 
    long long result = GetUIntLength(m_pReader, pos, len);
 
    if (result < 0)  //error
        return static_cast<long>(result);
 
    if (result > 0) //underflow (weird)
    {
        len = 1;
        return E_BUFFER_NOT_FULL;
    }
 
    if ((segment_stop >= 0) && ((pos + len) > segment_stop))
        return E_FILE_FORMAT_INVALID;
 
    if ((pos + len) > avail)
        return E_BUFFER_NOT_FULL;
 
    const long long idpos = pos;
 
    const long long id = ReadUInt(m_pReader, idpos, len);
 
    if (id != 0x0C53BB6B)  //Cues ID
        return E_FILE_FORMAT_INVALID;
 
    pos += len;  //consume ID
    assert((segment_stop < 0) || (pos <= segment_stop));
 
 
    if ((pos + 1) > avail)
    {
        len = 1;
        return E_BUFFER_NOT_FULL;
    }
 
    result = GetUIntLength(m_pReader, pos, len);
 
    if (result < 0)  //error
        return static_cast<long>(result);
 
    if (result > 0) //underflow (weird)
    {
        len = 1;
        return E_BUFFER_NOT_FULL;
    }
 
    if ((segment_stop >= 0) && ((pos + len) > segment_stop))
        return E_FILE_FORMAT_INVALID;
 
    if ((pos + len) > avail)
        return E_BUFFER_NOT_FULL;
 
    const long long size = ReadUInt(m_pReader, pos, len);
 
    if (size < 0)  //error
        return static_cast<long>(size);
 
    if (size == 0)  //weird, although technically not illegal
        return 1;   //done
 
    pos += len;  //consume length of size of element
    assert((segment_stop < 0) || (pos <= segment_stop));
 
 
    const long long element_stop = pos + size;
 
    if ((segment_stop >= 0) && (element_stop > segment_stop))
        return E_FILE_FORMAT_INVALID;
 
    if ((total >= 0) && (element_stop > total))
        return 1;  //don't bother parsing anymore
 
    len = static_cast<long>(size);
 
    if (element_stop > avail)
        return E_BUFFER_NOT_FULL;
 
    const long long element_size = element_stop - element_start;
 
    m_pCues = new (std::nothrow) Cues(
                                    this,
                                    pos,
                                    size,
                                    element_start,
                                    element_size);
    assert(m_pCues);  //TODO
 
    return 0;  //success
 }

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
Commit Message: libwebm: Pull from upstream

Rolling mkvparser from upstream. Primarily for fixing a bug on parsing
failures with certain Opus WebM files.

Upstream commit hash of this pull: 574045edd4ecbeb802ee3f1d214b5510269852ae

The diff is so huge because there were some style clean ups upstream.
But it was ensured that there were no breaking changes when the style
clean ups was done upstream.

Change-Id: Ib6e907175484b4b0ae1b55ab39522ea3188ad039