Code: void WT_InterpolateMono (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
{
    EAS_I32 *pMixBuffer;
 const EAS_I8 *pLoopEnd;
 const EAS_I8 *pCurrentPhaseInt;
    EAS_I32 numSamples;
    EAS_I32 gain;
    EAS_I32 gainIncrement;
    EAS_I32 currentPhaseFrac;
    EAS_I32 phaseInc;
    EAS_I32 tmp0;
    EAS_I32 tmp1;
    EAS_I32 tmp2;

     EAS_I8 *pLoopStart;
 
     numSamples = pWTIntFrame->numSamples;
     pMixBuffer = pWTIntFrame->pMixBuffer;
 
     /* calculate gain increment */
    gainIncrement = (pWTIntFrame->gainTarget - pWTIntFrame->prevGain) << (16 - SYNTH_UPDATE_PERIOD_IN_BITS);
 if (gainIncrement < 0)
        gainIncrement++;
    gain = pWTIntFrame->prevGain << 16;

    pCurrentPhaseInt = pWTVoice->pPhaseAccum;
    currentPhaseFrac = pWTVoice->phaseFrac;
    phaseInc = pWTIntFrame->phaseIncrement;

    pLoopStart = pWTVoice->pLoopStart;
    pLoopEnd = pWTVoice->pLoopEnd + 1;

InterpolationLoop:
    tmp0 = (EAS_I32)(pCurrentPhaseInt - pLoopEnd);
 if (tmp0 >= 0)
        pCurrentPhaseInt = pLoopStart + tmp0;

    tmp0 = *pCurrentPhaseInt;
    tmp1 = *(pCurrentPhaseInt + 1);

    tmp2 = phaseInc + currentPhaseFrac;

    tmp1 = tmp1 - tmp0;
    tmp1 = tmp1 * currentPhaseFrac;

    tmp1 = tmp0 + (tmp1 >> NUM_EG1_FRAC_BITS);

    pCurrentPhaseInt += (tmp2 >> NUM_PHASE_FRAC_BITS);
    currentPhaseFrac = tmp2 & PHASE_FRAC_MASK;

    gain += gainIncrement;
    tmp2 = (gain >> SYNTH_UPDATE_PERIOD_IN_BITS);

    tmp0 = *pMixBuffer;
    tmp2 = tmp1 * tmp2;
    tmp2 = (tmp2 >> 9);
    tmp0 = tmp2 + tmp0;
 *pMixBuffer++ = tmp0;

    numSamples--;
 if (numSamples > 0)
 goto InterpolationLoop;

    pWTVoice->pPhaseAccum = pCurrentPhaseInt;
    pWTVoice->phaseFrac = currentPhaseFrac;
 /*lint -e{702} <avoid divide>*/
    pWTVoice->gain = (EAS_I16)(gain >> SYNTH_UPDATE_PERIOD_IN_BITS);
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.
Commit Message: Sonivox: sanity check numSamples.

Bug: 26366256
Change-Id: I066888c25035ea4c60c88f316db4508dc4dab6bc
