Code: long mkvparser::UnserializeFloat(IMkvReader* pReader, long long pos,
                                 long long size_, double& result) {
  assert(pReader);
  assert(pos >= 0);
  if ((size_ != 4) && (size_ != 8))
     return E_FILE_FORMAT_INVALID;
 
   const long size = static_cast<long>(size_);

 unsigned char buf[8];

 const int status = pReader->Read(pos, size, buf);

 if (status < 0) // error
 return status;

 if (size == 4) {
 union {
 float f;
 unsigned long ff;
 };

    ff = 0;

 for (int i = 0;;) {
      ff |= buf[i];

 if (++i >= 4)
 break;

      ff <<= 8;
 }

 
     result = f;
   } else {
    assert(size == 8);
     union {
       double d;
       unsigned long long dd;
 };

    dd = 0;

 for (int i = 0;;) {
      dd |= buf[i];

 if (++i >= 8)
 break;

      dd <<= 8;
 }


     result = d;
   }
 
   return 0;
 }

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
