Code:  MediaMetadataRetriever::MediaMetadataRetriever()
 {
     ALOGV("constructor");
    const sp<IMediaPlayerService>& service(getService());
     if (service == 0) {
         ALOGE("failed to obtain MediaMetadataRetrieverService");
         return;
 }
    sp<IMediaMetadataRetriever> retriever(service->createMetadataRetriever());
 if (retriever == 0) {
        ALOGE("failed to create IMediaMetadataRetriever object from server");
 }
    mRetriever = retriever;
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.
Commit Message: Get service by value instead of reference

to prevent a cleared service binder from being used.

Bug: 26040840
Change-Id: Ifb5483c55b172d3553deb80dbe27f2204b86ecdb
