Code: const sp<IMediaPlayerService>& MediaMetadataRetriever::getService()
 {
     Mutex::Autolock lock(sServiceLock);
     if (sService == 0) {
        sp<IServiceManager> sm = defaultServiceManager();
        sp<IBinder> binder;
 do {
            binder = sm->getService(String16("media.player"));
 if (binder != 0) {
 break;
 }
            ALOGW("MediaPlayerService not published, waiting...");
            usleep(500000); // 0.5 s
 } while (true);
 if (sDeathNotifier == NULL) {
            sDeathNotifier = new DeathNotifier();
 }
        binder->linkToDeath(sDeathNotifier);
        sService = interface_cast<IMediaPlayerService>(binder);
 }
    ALOGE_IF(sService == 0, "no MediaPlayerService!?");
 return sService;
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.
Commit Message: Get service by value instead of reference

to prevent a cleared service binder from being used.

Bug: 26040840
Change-Id: Ifb5483c55b172d3553deb80dbe27f2204b86ecdb
