Code: void CuePoint::Load(IMkvReader* pReader) {
 
   if (m_timecode >= 0)  // already loaded
    return;
 
   assert(m_track_positions == NULL);
   assert(m_track_positions_count == 0);

 long long pos_ = -m_timecode;
 const long long element_start = pos_;

 long long stop;


   {
     long len;
 
    const long long id = ReadUInt(pReader, pos_, len);
    assert(id == 0x3B);  // CuePoint ID
     if (id != 0x3B)
      return;
 
     pos_ += len;  // consume ID
 
 const long long size = ReadUInt(pReader, pos_, len);
    assert(size >= 0);

    pos_ += len; // consume Size field

    stop = pos_ + size;
 }

 const long long element_size = stop - element_start;

 long long pos = pos_;



   while (pos < stop) {
     long len;
 
    const long long id = ReadUInt(pReader, pos, len);
    assert(id >= 0);  // TODO
    assert((pos + len) <= stop);
 
     pos += len;  // consume ID
 
     const long long size = ReadUInt(pReader, pos, len);
    assert(size >= 0);
    assert((pos + len) <= stop);
 
     pos += len;  // consume Size field
    assert((pos + size) <= stop);
 
     if (id == 0x33)  // CueTime ID
       m_timecode = UnserializeUInt(pReader, pos, size);

 else if (id == 0x37) // CueTrackPosition(s) ID

       ++m_track_positions_count;
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
  assert(m_timecode >= 0);
  assert(m_track_positions_count > 0);
 
 
  m_track_positions = new TrackPosition[m_track_positions_count];
 
 
 TrackPosition* p = m_track_positions;
  pos = pos_;


   while (pos < stop) {
     long len;
 
    const long long id = ReadUInt(pReader, pos, len);
    assert(id >= 0);  // TODO
    assert((pos + len) <= stop);
 
     pos += len;  // consume ID
 
 const long long size = ReadUInt(pReader, pos, len);
    assert(size >= 0);
    assert((pos + len) <= stop);

    pos += len; // consume Size field
    assert((pos + size) <= stop);

 
     if (id == 0x37) {  // CueTrackPosition(s) ID
       TrackPosition& tp = *p++;
      tp.Parse(pReader, pos, size);
     }
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
   assert(size_t(p - m_track_positions) == m_track_positions_count);
 
   m_element_start = element_start;
   m_element_size = element_size;
 }

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
