Code: static unsigned int subpel_variance_ref(const uint8_t *ref, const uint8_t *src,
                                        int l2w, int l2h, int xoff, int yoff,
                                        unsigned int *sse_ptr) {
  int se = 0;
  unsigned int sse = 0;
  const int w = 1 << l2w, h = 1 << l2h;
   for (int y = 0; y < h; y++) {
     for (int x = 0; x < w; x++) {
      const int a1 = ref[(w + 1) * (y + 0) + x + 0];
      const int a2 = ref[(w + 1) * (y + 0) + x + 1];
      const int b1 = ref[(w + 1) * (y + 1) + x + 0];
      const int b2 = ref[(w + 1) * (y + 1) + x + 1];
      const int a = a1 + (((a2 - a1) * xoff + 8) >> 4);
      const int b = b1 + (((b2 - b1) * xoff + 8) >> 4);
      const int r = a + (((b - a) * yoff + 8) >> 4);
      int diff = r - src[w * y + x];
      se += diff;
      sse += diff * diff;
     }
   }
  *sse_ptr = sse;
  return sse - (((int64_t) se * se) >> (l2w + l2h));
 }

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
Commit Message: Merge Conflict Fix CL to lmp-mr1-release for ag/849478

DO NOT MERGE - libvpx: Pull from upstream

Current HEAD: 7105df53d7dc13d5e575bc8df714ec8d1da36b06

BUG=23452792

Change-Id: Ic78176fc369e0bacc71d423e0e2e6075d004aaec
