CVE-2026-0040 AI-generated analysis
platform/external/dng_sdk, libdng_sdk (DNG image library, build configuration in Android.bp)
Rebuilds libdng_sdk in platform/external/dng_sdk so that signed/unsigned integer overflow detected by UBSan throws a C++ std::runtime_error (through a new in-tree runtime, ubsan-replacement/ubsan_throwing_runtime.cpp) instead of using the ubsan-minimal runtime, which hard-aborts.
Root cause
libdng_sdk-defaults in Android.bp enables sanitize.misc_undefined = [unsigned-integer-overflow, signed-integer-overflow]. With that configuration the ubsan-minimal runtime is used, and the commit message says it does a hard abort on a detected overflow. Any detected integer overflow in the DNG SDK's arithmetic while processing a crafted DNG therefore ended the hosting process instead of producing a recoverable error. This was the case even though the library is already built with rtti: true and cppflags -fexceptions, and the commit message says C++ exceptions are enabled in this library. The commit lists seven bug IDs (470966846, 467994860, 467994310, 461790658, 456471487, 453649377, 449728942). The material does not show the individual arithmetic sites.
How the fix works
- Android.bp :: cc_library libdng_sdk: adds sanitize: { never: true }. Per the in-file comment, this disables the ubsan_minimal runtime so the library can inject its own, overriding the Soong sanitizer handling inherited from libdng_sdk-defaults.
- Android.bp :: cc_library libdng_sdk: re-enables the overflow checks directly with the cflag -fsanitize=signed-integer-overflow,unsigned-integer-overflow and adds -fno-sanitize-link-runtime, so overflows are still instrumented but no sanitizer runtime is linked. The existing -DqDNGValidate=0 is kept.
- Android.bp :: cc_library libdng_sdk: adds ubsan-replacement/ubsan_throwing_runtime.cpp to srcs. This file supplies the handler symbols that the instrumentation calls.
- ubsan-replacement/ubsan_throwing_runtime.cpp: defines extern "C" hidden-visibility __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow. Each one throws std::runtime_error("ubsan: <kind>"). Because the library is compiled with -fexceptions (libdng_sdk-defaults, Android.bp lines 141-142), the exception propagates out of the SDK code to a caller that can catch it, instead of a hard abort.
- OWNERS: ownership metadata update only, no functional effect.
Completeness
- The fix works at the build/runtime level. It changes what happens on an overflow (an exception instead of an abort) but does not fix any overflowing arithmetic in the DNG SDK sources. No SDK source file is changed in this commit.
- Handlers are provided for add, sub, mul, negate and divrem overflow, the checks tied to the two sanitizers enabled through cflags. The _abort handler variants are not defined. Whether the build could ever emit calls to them is not shown.
- The thrown type is std::runtime_error. Whether every consumer of libdng_sdk catches it is not shown in the material. The commit's test, ImageDecoderTest#testInterestingDngs, covers the ImageDecoder path only.
- sanitize.never: true applies to the whole libdng_sdk module, so any other sanitizer Soong would otherwise apply to it is also dropped (general platform knowledge). The diff only re-adds the two integer-overflow checks through cflags.
Behavior changes
- An integer overflow detected in libdng_sdk now raises a C++ std::runtime_error with the message "ubsan: add-overflow", "ubsan: sub-overflow", "ubsan: mul-overflow", "ubsan: negate-overflow" or "ubsan: divrem-overflow" instead of aborting the process.
- libdng_sdk no longer links a sanitizer runtime (-fno-sanitize-link-runtime plus sanitize.never). Integer-overflow instrumentation is kept through explicit cflags.
- Callers whose process previously died now receive an exception or a decode failure, depending on how they handle it.
Per major
- Android 14: same fix: commit 42e65547eb33 in android-security-14.0.0_r28 (cherry-pick, per Cherrypick-From). At android-security-14.0.0_r29 the resolver reports 3/5 lines of the patched region present. The code context at that tag shows the new Android.bp sanitize/cflags/srcs block and ubsan_throwing_runtime.cpp.
- Android 15: same fix: commit 1ec41401b3d4 in android-security-15.0.0_r16. Android.bp and the runtime file are identical to the other branches, and only the prior OWNERS content differs. At android-security-15.0.0_r17 the resolver reports 3/4 lines of the patched region present.
- Android 16: same fix: commit 74a5a91d169a in android-security-16.0.0_r7. Android.bp and the runtime file are identical, and only the prior OWNERS content differs. At android-security-16.0.0_r8 the resolver reports 3/5 lines present.
- Android 17: same fix: commit 7937f2f835ab in the base release android-17.0.0_r1 (subject tagged RESTRICT AUTOMERGE). Android.bp and the runtime file are identical. At android-security-17.0.0_r1 the resolver reports 3/5 lines present.
Unknowns
- The specific overflowing expressions in the DNG SDK behind the seven referenced bugs are not shown.
- The material does not show which process hosts the decode in the reported scenario, so the scope of the DoS impact is unknown.
- Whether all consumers of libdng_sdk catch the new std::runtime_error, so that it does not itself end in termination from an uncaught exception, is not shown. Only ImageDecoderTest is cited.
- Whether the build could ever emit calls to the _abort handler variants that the new runtime does not define is not shown.
- The material does not explain why the per-major resolver reports only 3/5 (or 3/4) lines of the patched region present in the latest tags.