Android avc_decoder: buffer overflow in max_num_ref_frames enables local privilege escalation

A buffer overflow in the max_num_ref_frames handling of the avc_decoder lets a process write outside a heap buffer. Per the description, an attacker with local code execution can escalate privileges, and user interaction is needed to exploit it.