Code: long Track::GetFirst(const BlockEntry*& pBlockEntry) const {
 const Cluster* pCluster = m_pSegment->GetFirst();

 for (int i = 0;;) {
 if (pCluster == NULL) {
      pBlockEntry = GetEOS();
 return 1;

     }
 
     if (pCluster->EOS()) {
#if 0
            if (m_pSegment->Unparsed() <= 0) {  //all clusters have been loaded
                pBlockEntry = GetEOS();
                return 1;
            }
#else
       if (m_pSegment->DoneParsing()) {
         pBlockEntry = GetEOS();
         return 1;
       }
#endif
 
       pBlockEntry = 0;
       return E_BUFFER_NOT_FULL;
 }

 long status = pCluster->GetFirst(pBlockEntry);

 if (status < 0) // error
 return status;

 if (pBlockEntry == 0) { // empty cluster
      pCluster = m_pSegment->GetNext(pCluster);
 continue;
 }

 for (;;) {
 const Block* const pBlock = pBlockEntry->GetBlock();
      assert(pBlock);

 const long long tn = pBlock->GetTrackNumber();

 if ((tn == m_info.number) && VetEntry(pBlockEntry))
 return 0;

 const BlockEntry* pNextEntry;

      status = pCluster->GetNext(pBlockEntry, pNextEntry);

 if (status < 0) // error
 return status;

 if (pNextEntry == 0)
 break;

      pBlockEntry = pNextEntry;
 }

 ++i;

 if (i >= 100)
 break;

    pCluster = m_pSegment->GetNext(pCluster);
 }


  pBlockEntry = GetEOS(); // so we can return a non-NULL value
 return 1;
}

Vulnerability Type: DoS Exec Code Mem. Corr. 
CWE ID: CWE-20
Summary: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Commit Message: external/libvpx/libwebm: Update snapshot

Update libwebm snapshot. This update contains security fixes from upstream.

Upstream git hash: 229f49347d19b0ca0941e072b199a242ef6c5f2b

BUG=23167726

Change-Id: Id3e140e7b31ae11294724b1ecfe2e9c83b4d4207
(cherry picked from commit d0281a15b3c6bd91756e453cc9398c5ef412d99a)
