CVE-2025-0081 AI-generated analysis

platform/external/dng_sdk, lossless JPEG decoder (source/dng_lossless_jpeg.cpp)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

Adds a null-pointer check at the top of dng_lossless_decoder::HuffDecode in external/dng_sdk, so a null Huffman table during lossless JPEG decoding triggers ThrowBadFormat instead of being dereferenced.

Root cause

dng_lossless_decoder::HuffDecode (source/dng_lossless_jpeg.cpp) takes a HuffmanTable *htbl and goes straight to the fast 8-bit table lookup and the rest of decoding without checking that the pointer is non-null. The commit title ('Catch null HuffmanTables when decoding jpeg') shows the table pointer can be null at this point. The material does not show how it becomes null.

How the fix works

• source/dng_lossless_jpeg.cpp: dng_lossless_decoder::HuffDecode: inserts `if (htbl == nullptr) { ThrowBadFormat (); }` before the fast table lookup, so decoding stops with a bad-format error instead of dereferencing the null table.
• One commit with one hunk (4 added lines). No other files, headers or call sites are changed.

Completeness

• The check is at the point of use inside HuffDecode, so every caller of HuffDecode is covered whichever table is passed.
• The fix is defensive. It does not change where the table pointers are set or check table references while the scan header is parsed. The material does not show those code paths, so it is unknown whether other uses of HuffmanTable pointers outside HuffDecode go unchecked.
• Only the decoder side is touched. The encoder code in the same file is not modified, and the material gives no sign that it needs a change.

Behavior changes

• Decoding a lossless JPEG stream that reaches HuffDecode with a null Huffman table now calls ThrowBadFormat (a bad-format error) instead of dereferencing a null pointer.

Per major

• Android 14: same fix: commit 4b02aff0777b in android-security-14.0.0_r18 (cherry-pick, Change-Id Iaf36c076467d18e4e31d8436a6d199c3276a8786). 3/4 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: same fix: commit 7fc02c8d5af3 in android-security-15.0.0_r6, identical diff. 3/4 lines of the patched region are present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin). 3/4 lines of the patched region are present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin). 3/4 lines of the patched region are present at android-security-17.0.0_r1.

Unknowns

• How the Huffman table pointer becomes null (which part of stream parsing leaves it unset).
• Which Android processes or services decode through dng_sdk, and so which process would crash.
• Whether 12, 12L and 13 received the same patch; the per-major facts provided do not cover them.
• Whether the file uses HuffmanTable pointers elsewhere without going through HuffDecode.
• Why only 3/4 lines of the patched region match in the latest security tags.

Back to March 2025 · Findings