Code: EAS_BOOL WT_CheckSampleEnd (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame, EAS_BOOL update)
{
    EAS_U32 endPhaseAccum;
    EAS_U32 endPhaseFrac;
    EAS_I32 numSamples;
    EAS_BOOL done = EAS_FALSE;

 /* check to see if we hit the end of the waveform this time */
 /*lint -e{703} use shift for performance */
    endPhaseFrac = pWTVoice->phaseFrac + (pWTIntFrame->frame.phaseIncrement << SYNTH_UPDATE_PERIOD_IN_BITS);
    endPhaseAccum = pWTVoice->phaseAccum + GET_PHASE_INT_PART(endPhaseFrac);
 if (endPhaseAccum >= pWTVoice->loopEnd)
 {
 /* calculate how far current ptr is from end */
        numSamples = (EAS_I32) (pWTVoice->loopEnd - pWTVoice->phaseAccum);

 /* now account for the fractional portion */
 /*lint -e{703} use shift for performance */
        numSamples = (EAS_I32) ((numSamples << NUM_PHASE_FRAC_BITS) - pWTVoice->phaseFrac);
 if (pWTIntFrame->frame.phaseIncrement) {
            pWTIntFrame->numSamples = 1 + (numSamples / pWTIntFrame->frame.phaseIncrement);

         } else {
             pWTIntFrame->numSamples = numSamples;
         }
 
         /* sound will be done this frame */
         done = EAS_TRUE;
 }

 /* update data for off-chip synth */
 if (update)
 {
        pWTVoice->phaseFrac = endPhaseFrac;
        pWTVoice->phaseAccum = endPhaseAccum;
 }

 return done;
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.
Commit Message: Sonivox: sanity check numSamples.

Bug: 26366256
Change-Id: I066888c25035ea4c60c88f316db4508dc4dab6bc
