Code: int SoundPool::play(int sampleID, float leftVolume, float rightVolume,
 int priority, int loop, float rate)

 {
     ALOGV("play sampleID=%d, leftVolume=%f, rightVolume=%f, priority=%d, loop=%d, rate=%f",
             sampleID, leftVolume, rightVolume, priority, loop, rate);
    sp<Sample> sample;
     SoundChannel* channel;
     int channelID;
 
 Mutex::Autolock lock(&mLock);

 if (mQuit) {

         return 0;
     }
    sample = findSample(sampleID);
     if ((sample == 0) || (sample->state() != Sample::READY)) {
         ALOGW("  sample %d not READY", sampleID);
         return 0;
 }

    dump();

    channel = allocateChannel_l(priority);

 if (!channel) {
        ALOGV("No channel allocated");
 return 0;
 }

    channelID = ++mNextChannelID;

    ALOGV("play channel %p state = %d", channel, channel->state());
    channel->play(sample, channelID, leftVolume, rightVolume, priority, loop, rate);
 return channelID;
}

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: media/libmedia/SoundPool.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 mishandles locking requirements, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25781119.
Commit Message: DO NOT MERGE SoundPool: add lock for findSample access from SoundPoolThread

Sample decoding still occurs in SoundPoolThread
without holding the SoundPool lock.

Bug: 25781119
Change-Id: I11fde005aa9cf5438e0390a0d2dfe0ec1dd282e8
