Code:  int res_unpack(vorbis_info_residue *info,
		vorbis_info *vi,oggpack_buffer *opb){
   int j,k;
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   memset(info,0,sizeof(*info));

  info->type=oggpack_read(opb,16);
 if(info->type>2 || info->type<0)goto errout;
  info->begin=oggpack_read(opb,24);
  info->end=oggpack_read(opb,24);
  info->grouping=oggpack_read(opb,24)+1;
  info->partitions=(char)(oggpack_read(opb,6)+1);
  info->groupbook=(unsigned char)oggpack_read(opb,8);
 if(info->groupbook>=ci->books)goto errout;

  info->stagemasks=_ogg_malloc(info->partitions*sizeof(*info->stagemasks));
  info->stagebooks=_ogg_malloc(info->partitions*8*sizeof(*info->stagebooks));

 for(j=0;j<info->partitions;j++){
 int cascade=oggpack_read(opb,3);
 if(oggpack_read(opb,1))
      cascade|=(oggpack_read(opb,5)<<3);
    info->stagemasks[j]=cascade;
 }


   for(j=0;j<info->partitions;j++){
     for(k=0;k<8;k++){
       if((info->stagemasks[j]>>k)&1){
	unsigned char book=(unsigned char)oggpack_read(opb,8);
	if(book>=ci->books)goto errout;
	info->stagebooks[j*8+k]=book;
	if(k+1>info->stages)info->stages=k+1;
       }else
	info->stagebooks[j*8+k]=0xff;
     }
   }
 
 if(oggpack_eop(opb))goto errout;

 return 0;
 errout:
  res_clear_info(info);
 return 1;

 }

Vulnerability Type: DoS 
CWE ID: CWE-20
Summary: Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the number of partitions, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28556125.
Commit Message: Check partword is in range for # of partitions

and reformat tabs->spaces for readability.

Bug: 28556125
Change-Id: Id02819a6a5bcc24ba4f8a502081e5cb45272681c
