CVE-2024-40675 AI-generated analysis

platform/frameworks/base, core/java/android/content/Intent.java (Intent URI parsing, parseUri)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Intent.parseUri now throws URISyntaxException("uri end not found") when a name=value field in the new-format Intent URI loop has no ';' after it, instead of continuing with semi == -1.

Root cause

In Intent.parseUri, the loop over the new-format Intent URI body (`while (i >= 0 && !uri.startsWith("end", i))`) computes `int semi = uri.indexOf(';', i)` and did not check for -1 before going on with the iteration. When a field is not terminated by ';', parsing went on with semi == -1 instead of rejecting the input. The bulletin rates the result as a High-severity DoS. The material does not show the exact failure mode, because the code that advances the loop is outside the shown context.

How the fix works

• core/java/android/content/Intent.java:parseUri: right after `int semi = uri.indexOf(';', i);`, the fix adds `if (semi < 0) throw new URISyntaxException(uri, "uri end not found");`. Parsing now stops as soon as a field terminator is missing, before any later use of `semi` in the loop body.
• Single commit (c6b5490ec659) with 3 inserted lines and no other files touched. Test: atest IntentTest.

Completeness

• The fix covers only the new-format parsing loop in parseUri. Every field type handled inside that loop (action=, category=, type=, identifier=, ...) is covered, because the check runs before any field dispatch.
• This commit does not modify the old-format path `getIntentOld(uri, flags)` (line 7831). The material does not show its parsing code, so whether it has a similar issue is unknown.
• The `eq` handling (`if (eq < 0) eq = i-1;`) is unchanged. With the new check, `semi` is always >= i after the check.

Behavior changes

• Intent.parseUri now throws URISyntaxException with the message "uri end not found" for new-format intent URIs whose field list is missing a terminating ';'.
• Well-formed URIs, where every field is followed by ';', are not affected by the added check.

Per major

• Android 14: same fix: commit c6b5490ec659 in android-security-14.0.0_r13 (linked by bug_id 318683126). All 4/4 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: not affected (the bulletin does not list it). The patched region (4/4 lines) is present at android-security-15.0.0_r17.
• Android 16: not affected (the bulletin does not list it). The patched region (4/4 lines) is present at android-security-16.0.0_r8.
• Android 17: not affected (the bulletin does not list it). The patched region (4/4 lines) is present at android-security-17.0.0_r1.

Unknowns

• The exact failure mode with semi == -1 (for example how the loop advances `i`) is not in the shown context. Only the bulletin's DoS classification is known.
• Whether getIntentOld has a similar missing check is not shown.
• Which platform or system components call parseUri on untrusted input is not shown in the material.
• How such malformed input was handled before the fix (for example a hang or an exception) is not shown.

Back to October 2024 · Findings