Code: void WT_VoiceFilter (S_FILTER_CONTROL *pFilter, S_WT_INT_FRAME *pWTIntFrame)
{
    EAS_PCM *pAudioBuffer;
    EAS_I32 k;
    EAS_I32 b1;
    EAS_I32 b2;
    EAS_I32 z1;
    EAS_I32 z2;
    EAS_I32 acc0;
    EAS_I32 acc1;
    EAS_I32 numSamples;

 
     /* initialize some local variables */
     numSamples = pWTIntFrame->numSamples;
     pAudioBuffer = pWTIntFrame->pAudioBuffer;
 
     z1 = pFilter->z1;
    z2 = pFilter->z2;
    b1 = -pWTIntFrame->frame.b1;

 /*lint -e{702} <avoid divide> */
    b2 = -pWTIntFrame->frame.b2 >> 1;

 /*lint -e{702} <avoid divide> */
    k = pWTIntFrame->frame.k >> 1;

 while (numSamples--)
 {

 /* do filter calculations */
        acc0 = *pAudioBuffer;
        acc1 = z1 * b1;
        acc1 += z2 * b2;
        acc0 = acc1 + k * acc0;
        z2 = z1;

 /*lint -e{702} <avoid divide> */
        z1 = acc0 >> 14;
 *pAudioBuffer++ = (EAS_I16) z1;
 }

 /* save delay values     */
    pFilter->z1 = (EAS_I16) z1;
    pFilter->z2 = (EAS_I16) z2;
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.
Commit Message: Sonivox: sanity check numSamples.

Bug: 26366256
Change-Id: I066888c25035ea4c60c88f316db4508dc4dab6bc
