Code: long mkvparser::UnserializeString(IMkvReader* pReader, long long pos,
                                  long long size_, char*& str) {
   delete[] str;
   str = NULL;
 
  if (size_ >= LONG_MAX)  // we need (size+1) chars
     return E_FILE_FORMAT_INVALID;
 
  const long size = static_cast<long>(size_);
 
  str = new (std::nothrow) char[size + 1];
   if (str == NULL)
    return -1;
 
   unsigned char* const buf = reinterpret_cast<unsigned char*>(str);
 
 const long status = pReader->Read(pos, size, buf);

 if (status) {
 delete[] str;
    str = NULL;


     return status;
   }
 
  str[size] = '\0';
  return 0;  // success
 }

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
