Code: long long Segment::ParseHeaders() {
 long long total, available;

 const int status = m_pReader->Length(&total, &available);


   if (status < 0)  // error
     return status;
 
  assert((total < 0) || (available <= total));
 
   const long long segment_stop = (m_size < 0) ? -1 : m_start + m_size;
  assert((segment_stop < 0) || (total < 0) || (segment_stop <= total));
  assert((segment_stop < 0) || (m_pos <= segment_stop));
 
   for (;;) {
     if ((total >= 0) && (m_pos >= total))
 break;

 if ((segment_stop >= 0) && (m_pos >= segment_stop))
 break;


     long long pos = m_pos;
     const long long element_start = pos;
 
     if ((pos + 1) > available)
       return (pos + 1);
 
 long len;
 long long result = GetUIntLength(m_pReader, pos, len);


     if (result < 0)  // error
       return result;
 
    if (result > 0)  // underflow (weird)
       return (pos + 1);
 
     if ((segment_stop >= 0) && ((pos + len) > segment_stop))
       return E_FILE_FORMAT_INVALID;

 if ((pos + len) > available)

       return pos + len;
 
     const long long idpos = pos;
    const long long id = ReadUInt(m_pReader, idpos, len);
 
    if (id < 0)  // error
      return id;
 
     if (id == 0x0F43B675)  // Cluster ID
       break;

    pos += len; // consume ID

 if ((pos + 1) > available)
 return (pos + 1);

    result = GetUIntLength(m_pReader, pos, len);


     if (result < 0)  // error
       return result;
 
    if (result > 0)  // underflow (weird)
       return (pos + 1);
 
     if ((segment_stop >= 0) && ((pos + len) > segment_stop))
       return E_FILE_FORMAT_INVALID;

 if ((pos + len) > available)
 return pos + len;

 
     const long long size = ReadUInt(m_pReader, pos, len);
 
    if (size < 0)  // error
       return size;
 
     pos += len;  // consume length of size of element
 
     const long long element_size = size + pos - element_start;
 

 if ((segment_stop >= 0) && ((pos + size) > segment_stop))
 return E_FILE_FORMAT_INVALID;


 if ((pos + size) > available)
 return pos + size;

 if (id == 0x0549A966) { // Segment Info ID
 if (m_pInfo)
 return E_FILE_FORMAT_INVALID;

      m_pInfo = new (std::nothrow)
 SegmentInfo(this, pos, size, element_start, element_size);

 if (m_pInfo == NULL)
 return -1;

 const long status = m_pInfo->Parse();

 if (status)
 return status;
 } else if (id == 0x0654AE6B) { // Tracks ID
 if (m_pTracks)
 return E_FILE_FORMAT_INVALID;

      m_pTracks = new (std::nothrow)
 Tracks(this, pos, size, element_start, element_size);

 if (m_pTracks == NULL)
 return -1;

 const long status = m_pTracks->Parse();

 if (status)
 return status;
 } else if (id == 0x0C53BB6B) { // Cues ID
 if (m_pCues == NULL) {
        m_pCues = new (std::nothrow)
 Cues(this, pos, size, element_start, element_size);

 if (m_pCues == NULL)
 return -1;
 }
 } else if (id == 0x014D9B74) { // SeekHead ID
 if (m_pSeekHead == NULL) {
        m_pSeekHead = new (std::nothrow)
 SeekHead(this, pos, size, element_start, element_size);

 if (m_pSeekHead == NULL)
 return -1;

 const long status = m_pSeekHead->Parse();

 if (status)
 return status;
 }
 } else if (id == 0x0043A770) { // Chapters ID
 if (m_pChapters == NULL) {
        m_pChapters = new (std::nothrow)
 Chapters(this, pos, size, element_start, element_size);

 if (m_pChapters == NULL)
 return -1;

 const long status = m_pChapters->Parse();


         if (status)
           return status;
       }
     }
 
     m_pos = pos + size;  // consume payload
   }
 
  assert((segment_stop < 0) || (m_pos <= segment_stop));
 
   if (m_pInfo == NULL)  // TODO: liberalize this behavior
     return E_FILE_FORMAT_INVALID;

 if (m_pTracks == NULL)
 return E_FILE_FORMAT_INVALID;

 return 0; // success
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
