CVE-2024-49730 AI-generated analysis

platform/packages/providers/MediaProvider, FUSE daemon (jni/FuseDaemon.cpp)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Changes MediaProvider FuseDaemon's MAX_READ_SIZE from a fixed 128 KiB to FUSE_MAX_MAX_PAGES (256) * getpagesize(). Per the commit message, the goal is to make the zero_addr buffer as large as the largest single request.

Root cause

jni/FuseDaemon.cpp defined MAX_READ_SIZE as constexpr 128 * 1024. The commit title says zero_addr must be expanded to the maximum size of a single request, and the diff changes only MAX_READ_SIZE. This implies (an inference, not shown directly) that zero_addr was sized from MAX_READ_SIZE and could be smaller than a single request. The test name (RedactUriDeviceTest) suggests the redaction read path. The use site of zero_addr is not in the material.

How the fix works

• jni/FuseDaemon.cpp (file-scope constants): adds #define FUSE_MAX_MAX_PAGES 256 and replaces `constexpr size_t MAX_READ_SIZE = 128 * 1024;` with `const size_t MAX_READ_SIZE = FUSE_MAX_MAX_PAGES * getpagesize();`. This gives 1 MiB at 4 KiB pages and 4 MiB at 16 KiB pages.
• No bounds check is added in the diff. The fix relies only on the constant, and so (inferred) the buffer, being large enough.

Completeness

• The fix only enlarges the constant. The diff adds no explicit check comparing the request size against MAX_READ_SIZE. Correctness depends on 256 pages being the real upper bound for a single request.
• Any other users of MAX_READ_SIZE in FuseDaemon.cpp also get the larger value. Those sites are not shown.
• At the latest tags (14.0.0_r29, 15.0.0_r17, 16.0.0_r8, 17.0.0_r1), 4/5 lines of the patched region are present. The 14.0.0_r29 code context contains both new lines, so the line that differs appears to be context rather than the fix.

Behavior changes

• MAX_READ_SIZE changes from a compile-time constexpr to a runtime-initialized const that depends on getpagesize().
• MAX_READ_SIZE grows from 128 KiB to 256 pages (1 MiB on 4 KiB-page devices, 4 MiB on 16 KiB-page devices).

Per major

• Android 14: same fix: commit 961c8cbd2a48 in android-security-14.0.0_r19 (cherry-pick of e45ef2e4c41c). The fix lines are present at android-security-14.0.0_r29.
• Android 15: not affected (not listed by the bulletin). 4/5 lines of the patched region are present at android-security-15.0.0_r17.
• Android 16: not affected (not listed by the bulletin). 4/5 lines of the patched region are present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin). 4/5 lines of the patched region are present at android-security-17.0.0_r1.

Unknowns

• How and where zero_addr is allocated and used, and what memory operation exceeded it.
• Whether zero_addr is in fact sized from MAX_READ_SIZE (inferred, not shown).
• Other references to MAX_READ_SIZE in FuseDaemon.cpp.
• Which line of the 5-line patched region differs at the latest tags.
• Whether Android 13 (listed as affected) received a corresponding commit.
• The bulletin lists '15-next' among affected versions, while the per-major facts say Android 15 is not listed.

Back to April 2025 · Findings