Code: long SeekHead::Parse() {
 IMkvReader* const pReader = m_pSegment->m_pReader;

 long long pos = m_start;
 const long long stop = m_start + m_size;


 int entry_count = 0;
 int void_element_count = 0;

 while (pos < stop) {
 long long id, size;

 const long status = ParseElementHeader(pReader, pos, stop, id, size);

 if (status < 0) // error
 return status;

 if (id == 0x0DBB) // SeekEntry ID
 ++entry_count;
 else if (id == 0x6C) // Void ID

       ++void_element_count;
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
  assert(pos == stop);
 
   m_entries = new (std::nothrow) Entry[entry_count];
 
 if (m_entries == NULL)
 return -1;

  m_void_elements = new (std::nothrow) VoidElement[void_element_count];

 if (m_void_elements == NULL)
 return -1;


 Entry* pEntry = m_entries;
 VoidElement* pVoidElement = m_void_elements;

  pos = m_start;

 while (pos < stop) {
 const long long idpos = pos;

 long long id, size;

 const long status = ParseElementHeader(pReader, pos, stop, id, size);

 if (status < 0) // error
 return status;

 if (id == 0x0DBB) { // SeekEntry ID
 if (ParseEntry(pReader, pos, size, pEntry)) {
 Entry& e = *pEntry++;

        e.element_start = idpos;
        e.element_size = (pos + size) - idpos;
 }
 } else if (id == 0x6C) { // Void ID
 VoidElement& e = *pVoidElement++;

      e.element_start = idpos;
      e.element_size = (pos + size) - idpos;

     }
 
     pos += size;  // consume payload
    assert(pos <= stop);
   }
 
  assert(pos == stop);
 
   ptrdiff_t count_ = ptrdiff_t(pEntry - m_entries);
   assert(count_ >= 0);
  assert(count_ <= entry_count);

  m_entry_count = static_cast<int>(count_);

  count_ = ptrdiff_t(pVoidElement - m_void_elements);
  assert(count_ >= 0);
  assert(count_ <= void_element_count);

  m_void_element_count = static_cast<int>(count_);

 return 0;
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
