Code: long Tracks::Parse() {
  assert(m_trackEntries == NULL);
  assert(m_trackEntriesEnd == NULL);

 const long long stop = m_start + m_size;
 IMkvReader* const pReader = m_pSegment->m_pReader;

 int count = 0;
 long long pos = m_start;

 while (pos < stop) {
 long long id, size;

 const long status = ParseElementHeader(pReader, pos, stop, id, size);

 if (status < 0) // error
 return status;

 if (size == 0) // weird
 continue;

 if (id == 0x2E) // TrackEntry ID

       ++count;
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
  assert(pos == stop);
 
   if (count <= 0)
     return 0;  // success
 
  m_trackEntries = new (std::nothrow) Track* [count];
 
   if (m_trackEntries == NULL)
     return -1;

  m_trackEntriesEnd = m_trackEntries;

  pos = m_start;

 while (pos < stop) {
 const long long element_start = pos;

 long long id, payload_size;

 const long status =
 ParseElementHeader(pReader, pos, stop, id, payload_size);

 if (status < 0) // error
 return status;

 if (payload_size == 0) // weird
 continue;

 const long long payload_stop = pos + payload_size;
    assert(payload_stop <= stop); // checked in ParseElement

 const long long element_size = payload_stop - element_start;

 if (id == 0x2E) { // TrackEntry ID
 Track*& pTrack = *m_trackEntriesEnd;
      pTrack = NULL;

 const long status = ParseTrackEntry(pos, payload_size, element_start,
                                          element_size, pTrack);

 if (status)
 return status;

 if (pTrack)
 ++m_trackEntriesEnd;

     }
 
     pos = payload_stop;
    assert(pos <= stop);
   }
 
  assert(pos == stop);
 
   return 0;  // success
 }

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
