Code: static vpx_codec_err_t vp8_peek_si_internal(const uint8_t *data,
 unsigned int data_sz,
 vpx_codec_stream_info_t *si,
                                            vpx_decrypt_cb decrypt_cb,
 void *decrypt_state)
{
 vpx_codec_err_t res = VPX_CODEC_OK;

 if(data + data_sz <= data)
 {
        res = VPX_CODEC_INVALID_PARAM;
 }
 else
 {
 /* Parse uncompresssed part of key frame header.
         * 3 bytes:- including version, frame type and an offset
         * 3 bytes:- sync code (0x9d, 0x01, 0x2a)
         * 4 bytes:- including image width and height in the lowest 14 bits
         *           of each 2-byte value.
         */
 uint8_t clear_buffer[10];
 const uint8_t *clear = data;
 if (decrypt_cb)
 {
 int n = MIN(sizeof(clear_buffer), data_sz);
            decrypt_cb(decrypt_state, data, clear_buffer, n);
            clear = clear_buffer;
 }
        si->is_kf = 0;

 if (data_sz >= 10 && !(clear[0] & 0x01)) /* I-Frame */
 {
            si->is_kf = 1;

 /* vet via sync code */
 if (clear[3] != 0x9d || clear[4] != 0x01 || clear[5] != 0x2a)
 return VPX_CODEC_UNSUP_BITSTREAM;

            si->w = (clear[6] | (clear[7] << 8)) & 0x3fff;

             si->h = (clear[8] | (clear[9] << 8)) & 0x3fff;
 
             /*printf("w=%d, h=%d\n", si->w, si->h);*/
            if (!(si->h | si->w))
                res = VPX_CODEC_UNSUP_BITSTREAM;
         }
         else
         {
            res = VPX_CODEC_UNSUP_BITSTREAM;
 }
 }

 return res;
}

Vulnerability Type: DoS 
CWE ID: CWE-20
Summary: A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593765.
Commit Message: DO NOT MERGE | libvpx: Cherry-pick 0f42d1f from upstream

Description from upstream:
vp8: fix decoder crash with invalid leading keyframes

decoding the same invalid keyframe twice would result in a crash as the
second time through the decoder would be assumed to have been
initialized as there was no resolution change. in this case the
resolution was itself invalid (0x6), but vp8_peek_si() was only failing
in the case of 0x0.
invalid-vp80-00-comprehensive-018.ivf.2kf_0x6.ivf tests this case by
duplicating the first keyframe and additionally adds a valid one to
ensure decoding can resume without error.

Bug: 30593765
Change-Id: I0de85f5a5eb5c0a5605230faf20c042b69aea507
(cherry picked from commit fc0466b695dce03e10390101844caa374848d903)
(cherry picked from commit 1114575245cb9d2f108749f916c76549524f5136)
