Code: long ContentEncoding::ParseCompressionEntry(long long start, long long size,
 IMkvReader* pReader,
 ContentCompression* compression) {
  assert(pReader);
  assert(compression);

 long long pos = start;
 const long long stop = start + size;

 bool valid = false;

 while (pos < stop) {
 long long id, size;
 const long status = ParseElementHeader(pReader, pos, stop, id, size);
 if (status < 0) // error
 return status;

 if (id == 0x254) {
 long long algo = UnserializeUInt(pReader, pos, size);
 if (algo < 0)
 return E_FILE_FORMAT_INVALID;
      compression->algo = algo;
      valid = true;
 } else if (id == 0x255) {
 if (size <= 0)

         return E_FILE_FORMAT_INVALID;
 
       const size_t buflen = static_cast<size_t>(size);
      typedef unsigned char* buf_t;
      const buf_t buf = new (std::nothrow) unsigned char[buflen];
       if (buf == NULL)
         return -1;
 
 const int read_status =
          pReader->Read(pos, static_cast<long>(buflen), buf);
 if (read_status) {
 delete[] buf;
 return status;
 }

      compression->settings = buf;
      compression->settings_len = buflen;

     }
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
 if (!valid)
 return E_FILE_FORMAT_INVALID;

 return 0;
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
