CVE-2025-48632 AI-generated analysis

platform/frameworks/base, Companion Device Manager (android.companion.AssociationRequest)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

Adds a shared validateDisplayName() length check (DISPLAY_NAME_LENGTH_LIMIT = 1024) to the private AssociationRequest constructor and the @hide setDisplayName() in core/java/android/companion/AssociationRequest.java. Before this, the display-name limit was enforced only in Builder.setDisplayName().

Root cause

AssociationRequest.mDisplayName had a 1024-character limit (DISPLAY_NAME_LENGTH_LIMIT). Before the fix, that limit was checked only in Builder.setDisplayName(). The private constructor AssociationRequest(boolean, List, String, CharSequence, boolean, boolean) stored displayName without validation. The @hide public setDisplayName(CharSequence) overwrote mDisplayName with no validation at all. Any code that reached those paths could therefore create an AssociationRequest with an arbitrarily long display name. Per the field's javadoc, this name is shown in the CDM confirmation UI.

How the fix works

• core/java/android/companion/AssociationRequest.java: new private static helper validateDisplayName(@Nullable CharSequence). It throws IllegalArgumentException when displayName is non-null and displayName.length() > DISPLAY_NAME_LENGTH_LIMIT (1024). Null is accepted.
• AssociationRequest.java: the private constructor AssociationRequest(singleDevice, deviceFilters, deviceProfile, displayName, selfManaged, forceConfirmation) now calls validateDisplayName(displayName) as its first statement, before any field is assigned.
• AssociationRequest.java: @hide setDisplayName(CharSequence) now calls validateDisplayName(displayName) before assigning mDisplayName.
• AssociationRequest.java: Builder.setDisplayName(@NonNull CharSequence) replaces its inline length check with a call to validateDisplayName(displayName). requireNonNull(displayName) and checkNotUsed() are kept, so behavior there is unchanged.

Completeness

• Adds validation to the explicit-argument private constructor and to the @hide setDisplayName() on AssociationRequest. The existing check in Builder.setDisplayName() (which sets the Builder's own field) is moved into the same helper.
• The Parcel-reading constructor AssociationRequest(Parcel in) is not modified by this commit. CREATOR.createFromParcel calls it ('return new AssociationRequest(in)' in the diff context). The material does not show whether an over-length displayName arriving via Parcel is validated.
• Validation is length-only (character count against 1024). No other constraints on displayName content are introduced.

Behavior changes

• The private constructor now throws IllegalArgumentException("Length of the display name must be at most 1024 characters") for a non-null displayName longer than 1024 characters. Before the fix it accepted any value.
• The @hide setDisplayName(CharSequence) now throws the same IllegalArgumentException for over-length values. Null is still accepted by that method and by the constructor.
• Builder.setDisplayName() behavior is unchanged. It still rejects null via requireNonNull and over-length values with the same exception message.

Per major

• Android 14: same fix: platform/frameworks/base a100e23a3fda in android-security-14.0.0_r24 (cherry-pick of 872038799ed1, Change-Id I41dc3804c35328a5968716f502c4320a58b75158); 8/8 lines of the patched region present at android-security-14.0.0_r29.
• Android 15: same fix: e72cdc5c770d in android-security-15.0.0_r12. The logic is identical; the only difference is a blank line in Builder.setDisplayName(). 8/8 lines present at android-security-15.0.0_r17.
• Android 16: adapted fix: de27b16b1af8 in android-security-16.0.0_r3. It makes the same three validateDisplayName() insertions, but the private constructor has extra parameters (skipRoleGrant, @Nullable Icon deviceIcon) and the hunks sit at different line offsets. 8/8 lines present at android-security-16.0.0_r8.
• Android 17: not affected: the bulletin does not list Android 17. 7/8 lines of the patched region are present at android-security-17.0.0_r1.

Unknowns

• Which callers invoke the @hide setDisplayName(CharSequence) or otherwise reach the private constructor with an unvalidated displayName. The index search returned only unrelated setDisplayName methods (Contacts, SubscriptionManager).
• Whether the Parcel constructor AssociationRequest(Parcel) validates displayName. It is not in the diff or the provided context.
• What exactly the 7/8 partial match of the patched region at android-security-17.0.0_r1 reflects.
• The concrete consequence of an over-length display name in the CDM confirmation UI that led to the High/EoP rating. The material does not describe it.

Back to December 2025 · Findings