CVE-2025-22423 AI-generated analysis
platform/external/dng_sdk, DNG/TIFF IFD tag parser (source/dng_ifd.cpp)
dng_ifd::ParseTag in external/dng_sdk now aborts tag parsing (returns false) when CheckTagCount reports an invalid tag count for three tags, instead of ignoring the result and continuing to process the out-of-range count.
Root cause
In source/dng_ifd.cpp, dng_ifd::ParseTag called CheckTagCount(parentCode, tagCode, tagCount, ...) for several tags but discarded its boolean result. When a file carried a tag count outside the allowed range, parsing continued anyway. For tcBitsPerSample the following code loops `for (j = 0; j < tagCount; j++)` reading one value per iteration from the stream, so an unvalidated count directly controls the amount of work and reads done; the two other patched sites check the count against fSamplesPerPixel and likewise continued with an invalid count. The bulletin rates the issue as a Critical DoS.
How the fix works
- source/dng_ifd.cpp: dng_ifd::ParseTag, case tcBitsPerSample (hunk at line 351): `CheckTagCount (parentCode, tagCode, tagCount, 1, 0x0FFFF)` is wrapped in `if (!CheckTagCount(...)) return false;` so the per-value read loop is not entered with an out-of-range count.
- source/dng_ifd.cpp: dng_ifd::ParseTag, second site (hunk at line 973, tag not named in the material): `CheckTagCount (parentCode, tagCode, tagCount, 1, fSamplesPerPixel)` now returns false from ParseTag on failure.
- source/dng_ifd.cpp: dng_ifd::ParseTag, third site (hunk at line 1025, tag not named in the material): `CheckTagCount (parentCode, tagCode, tagCount, fSamplesPerPixel)` now returns false from ParseTag on failure.
- Single commit, 6 insertions / 3 deletions in source/dng_ifd.cpp only; it wraps three existing CheckTagCount calls and does not change CheckTagCount itself.
Completeness
- Covers exactly three CheckTagCount call sites in dng_ifd::ParseTag: tcBitsPerSample and two sites bounded by fSamplesPerPixel.
- Other CheckTagCount calls in the same function still ignore the return value, e.g. case tcImageLength at line 365 (`CheckTagCount (parentCode, tagCode, tagCount, 1);`) in the android-security-14.0.0_r29 context; that site reads a single value via stream.TagValue_uint32, so the count does not drive a loop there.
- CheckTagType results remain unchecked at all three patched sites (unchanged by this fix).
- The fix relies on the caller of ParseTag handling a false return; that caller is not shown in the material.
Behavior changes
- ParseTag now returns false for BitsPerSample with a count outside 1..0xFFFF, and for the two fSamplesPerPixel-checked tags with counts failing their check; previously such tags were still parsed.
- Whether this surfaces as a file load failure or a skipped tag depends on the ParseTag caller (not shown).
Per major
- Android 14: Same fix: commit 748dbd7dfcec in android-security-14.0.0_r19 (cherry-pick). The android-security-14.0.0_r29 context shows the `if (!CheckTagCount (...)) return false;` guard present in tcBitsPerSample.
- Android 15: Same fix: commit bbed5f198692 in android-security-15.0.0_r7, same diff (identical blob indexes) as the Android 14 commit.
- Android 16: Not affected (not listed by the bulletin). The heuristic reports 5/8 lines of the patched region at android-security-16.0.0_r8.
- Android 17: Not affected (not listed by the bulletin). The heuristic reports 5/8 lines of the patched region at android-security-17.0.0_r1.
Unknowns
- The tag cases at lines ~973 and ~1025 are not named in the diff hunks or context.
- How the caller of dng_ifd::ParseTag reacts to a false return (error vs. skip) is not shown.
- Which Android process parses untrusted DNG files with dng_sdk, and therefore the actual attack surface, is not shown.
- Status of Android 13 (listed as affected) is not covered by the per-major facts.