A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls)

A newly disclosed Android telephony bug lets a single malformed WAP Push SMS crash the com.android.phone process with no user interaction, dropping active calls including emergency calls. The root cause is an unchecked cast of a WSP header length to a signed int, which produces a negative array size.