Code: status_t MediaPlayer::setDataSource(int fd, int64_t offset, int64_t length)

 {
     ALOGV("setDataSource(%d, %" PRId64 ", %" PRId64 ")", fd, offset, length);
     status_t err = UNKNOWN_ERROR;
    const sp<IMediaPlayerService>& service(getMediaPlayerService());
     if (service != 0) {
         sp<IMediaPlayer> player(service->create(this, mAudioSessionId));
         if ((NO_ERROR != doSetRetransmitEndpoint(player)) ||
 (NO_ERROR != player->setDataSource(fd, offset, length))) {
            player.clear();
 }
        err = attachNewPlayer(player);
 }
 return err;
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-476
Summary: libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference or memory corruption) via a crafted media file, aka internal bug 28166152.
Commit Message: Don't use sp<>&

because they may end up pointing to NULL after a NULL check was performed.

Bug: 28166152
Change-Id: Iab2ea30395b620628cc6f3d067dd4f6fcda824fe
