Code: void OMX::binderDied(const wp<IBinder> &the_late_who) {
 OMXNodeInstance *instance;

 {

         Mutex::Autolock autoLock(mLock);
 
         ssize_t index = mLiveNodes.indexOfKey(the_late_who);
        CHECK(index >= 0);
 
         instance = mLiveNodes.editValueAt(index);
         mLiveNodes.removeItemsAt(index);

        index = mDispatchers.indexOfKey(instance->nodeID());
        CHECK(index >= 0);
        mDispatchers.removeItemsAt(index);

        invalidateNodeID_l(instance->nodeID());
 }

    instance->onObserverDied(mMaster);
}

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27597103.
Commit Message: Add VPX output buffer size check

and handle dead observers more gracefully

Bug: 27597103
Change-Id: Id7acb25d5ef69b197da15ec200a9e4f9e7b03518
