Code: int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) {
 int new_mi_size;

  vp9_set_mb_mi(cm, width, height);
  new_mi_size = cm->mi_stride * calc_mi_size(cm->mi_rows);
 if (cm->mi_alloc_size < new_mi_size) {
    cm->free_mi(cm);
 if (cm->alloc_mi(cm, new_mi_size))
 goto fail;
 }

 if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
    free_seg_map(cm);
 if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols))
 goto fail;
 }

 if (cm->above_context_alloc_cols < cm->mi_cols) {
    vpx_free(cm->above_context);
    cm->above_context = (ENTROPY_CONTEXT *)vpx_calloc(
 2 * mi_cols_aligned_to_sb(cm->mi_cols) * MAX_MB_PLANE,
 sizeof(*cm->above_context));
 if (!cm->above_context) goto fail;

    vpx_free(cm->above_seg_context);
    cm->above_seg_context = (PARTITION_CONTEXT *)vpx_calloc(
        mi_cols_aligned_to_sb(cm->mi_cols), sizeof(*cm->above_seg_context));
 if (!cm->above_seg_context) goto fail;
    cm->above_context_alloc_cols = cm->mi_cols;
 }


   return 0;
 
  fail:
   vp9_free_context_buffers(cm);
   return 1;
 }

Vulnerability Type: DoS 
CWE ID: CWE-20
Summary: A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752.
Commit Message: DO NOT MERGE libvpx: Cherry-pick 8b4c315 from upstream

Description from upstream:
vp9_alloc_context_buffers: clear cm->mi* on failure

this fixes a crash in vp9_dec_setup_mi() via
vp9_init_context_buffers() should decoding continue and the decoder
resyncs on a smaller frame

Bug: 30593752
Change-Id: Iafbf1c4114062bf796f51a6b03be71328f7bcc69
(cherry picked from commit 737c8493693243838128788fe9c3abc51f17338e)
(cherry picked from commit 3e88ffac8c80b76e15286ef8a7b3bd8fa246c761)
