Code:  void WT_NoiseGenerator (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
 {
    EAS_PCM *pOutputBuffer;
    EAS_I32 phaseInc;
    EAS_I32 tmp0;
    EAS_I32 tmp1;
    EAS_I32 nInterpolatedSample;
    EAS_I32 numSamples;

 
     /* initialize some local variables */
     numSamples = pWTIntFrame->numSamples;
     pOutputBuffer = pWTIntFrame->pAudioBuffer;
     phaseInc = pWTIntFrame->frame.phaseIncrement;
 
 /* get last two samples generated */
 /*lint -e{704} <avoid divide for performance>*/
    tmp0 = (EAS_I32) (pWTVoice->phaseAccum) >> 18;
 /*lint -e{704} <avoid divide for performance>*/
    tmp1 = (EAS_I32) (pWTVoice->loopEnd) >> 18;

 /* generate a buffer of noise */
 while (numSamples--) {
        nInterpolatedSample = MULT_AUDIO_COEF( tmp0, (PHASE_ONE - pWTVoice->phaseFrac));
        nInterpolatedSample += MULT_AUDIO_COEF( tmp1, pWTVoice->phaseFrac);
 *pOutputBuffer++ = (EAS_PCM) nInterpolatedSample;

 /* update PRNG */
        pWTVoice->phaseFrac += (EAS_U32) phaseInc;
 if (GET_PHASE_INT_PART(pWTVoice->phaseFrac)) {
            tmp0 = tmp1;
            pWTVoice->phaseAccum = pWTVoice->loopEnd;
            pWTVoice->loopEnd = (5 * pWTVoice->loopEnd + 1);
            tmp1 = (EAS_I32) (pWTVoice->loopEnd) >> 18;
            pWTVoice->phaseFrac = GET_PHASE_FRAC_PART(pWTVoice->phaseFrac);
 }

 }
}

Vulnerability Type: DoS Exec Code Overflow Mem. Corr. 
CWE ID: CWE-119
Summary: Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.
Commit Message: Sonivox: sanity check numSamples.

Bug: 26366256
Change-Id: I066888c25035ea4c60c88f316db4508dc4dab6bc
