Code: long long mkvparser::ReadUInt(IMkvReader* pReader, long long pos, long& len) {
  assert(pReader);
  assert(pos >= 0);
  int status;
 
   len = 1;
   unsigned char b;
  status = pReader->Read(pos, 1, &b);
 
   if (status < 0)  // error or underflow
     return status;

 if (status > 0) // interpreted as "underflow"
 return E_BUFFER_NOT_FULL;

 if (b == 0) // we can't handle u-int values larger than 8 bytes
 return E_FILE_FORMAT_INVALID;

 unsigned char m = 0x80;

 while (!(b & m)) {
    m >>= 1;

     ++len;
   }
 
   long long result = b & (~m);
   ++pos;
 
 for (int i = 1; i < len; ++i) {
    status = pReader->Read(pos, 1, &b);

 if (status < 0) {
      len = 1;
 return status;
 }

 if (status > 0) {
      len = 1;
 return E_BUFFER_NOT_FULL;
 }

    result <<= 8;
    result |= b;

 ++pos;
 }


   return result;
 }

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
