CVE-2026-0041 AI-generated analysis
platform/external/dng_sdk, libdng_sdk (Android.bp build config and UBSan runtime replacement)
Rebuilds libdng_sdk without the ubsan-minimal runtime and links a project-local replacement (ubsan-replacement/ubsan_throwing_runtime.cpp) whose integer-overflow handlers throw std::runtime_error, so a UBSan-detected signed/unsigned integer overflow in libdng_sdk becomes a C++ exception instead of a hard abort.
Root cause
In Android.bp, libdng_sdk-defaults enables sanitize.misc_undefined for unsigned-integer-overflow and signed-integer-overflow. libdng_sdk inherited these defaults together with the ubsan_minimal runtime. With that runtime, an integer overflow detected at runtime inside libdng_sdk causes a hard abort of the hosting process. The commit references seven bug IDs (470966846, 467994860, 467994310, 461790658, 456471487, 453649377, 449728942). The specific arithmetic sites are not in the diff; the fix handles all of them at the runtime level.
How the fix works
- Android.bp, cc_library libdng_sdk: adds sanitize.never: true. The comment explains that Soong has no flag to drop only the ubsan_minimal runtime, so 'never' is combined with explicit -fsanitize cflags.
- Android.bp, cc_library libdng_sdk: cflags now include -fsanitize=signed-integer-overflow,unsigned-integer-overflow, which re-enables the same two checks the defaults request, and -fno-sanitize-link-runtime. -DqDNGValidate=0 is kept.
- Android.bp, cc_library libdng_sdk: srcs adds ubsan-replacement/ubsan_throwing_runtime.cpp, so the replacement handlers are compiled into libdng_sdk.
- ubsan-replacement/ubsan_throwing_runtime.cpp (new file): defines extern "C" hidden-visibility __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow. Each one throws std::runtime_error with a short message. libdng_sdk-defaults already sets rtti: true and cppflags -fexceptions (Android.bp lines 141-142), and the commit message says C++ exceptions are enabled in this library.
- OWNERS: metadata only (bug component and owner list). No functional effect.
Completeness
- Covers only libdng_sdk's own code. The overflowing arithmetic itself is not changed; only the outcome of a detected overflow changes.
- Only five handlers are provided (add, sub, mul, negate, divrem). The defaults enable only the two integer-overflow checks, and no other UBSan classes are added.
- The handlers are declared with no parameters, and the exception messages contain no source location.
- The handlers have hidden visibility, so they are not exported from libdng_sdk.
- The material does not show whether callers of libdng_sdk catch std::runtime_error. If no caller catches it, the process would still terminate.
Behavior changes
- On a UBSan-detected integer overflow inside libdng_sdk, a std::runtime_error is thrown ("ubsan: add-overflow", "ubsan: sub-overflow", "ubsan: mul-overflow", "ubsan: negate-overflow" or "ubsan: divrem-overflow") instead of the process aborting.
- libdng_sdk no longer uses the Soong-provided ubsan_minimal runtime (sanitize.never plus -fno-sanitize-link-runtime). Instrumentation for the two overflow checks is kept through explicit cflags.
- Exceptions can now leave libdng_sdk overflow sites, where previously the process aborted.
Per major
- Android 14: same fix: commit 42e65547eb33 in android-security-14.0.0_r28 (cherry-picked from three internal changes). The Android.bp hunk and the new ubsan_throwing_runtime.cpp are the same as on the other branches. The OWNERS diff differs only in the old owner list. The code shown at android-security-14.0.0_r29 contains the fix, although the per-major facts report 3/5 lines of the patched region present.
- Android 15: same fix: commit 1ec41401b3d4 in android-security-15.0.0_r16. The Android.bp and new-file blob indexes are identical to the 14 change; OWNERS differs only in prior content. Per-major facts report 3/4 lines of the patched region present at android-security-15.0.0_r17.
- Android 16: same fix: commit 74a5a91d169a in android-security-16.0.0_r7. Android.bp and the new file are identical; OWNERS differs only in prior content. Per-major facts report 3/5 lines of the patched region present at android-security-16.0.0_r8.
- Android 17: same fix: commit 7937f2f835ab in android-17.0.0_r1 (resolved in base), titled with RESTRICT AUTOMERGE. Android.bp and the new file are identical. Per-major facts report 3/5 lines of the patched region present at android-security-17.0.0_r1.
Unknowns
- Which arithmetic sites in dng_sdk overflow for the seven referenced bugs, and which input fields cause them.
- Whether the thrown std::runtime_error is caught inside dng_sdk or by consumers (for example the ImageDecoder path), so that decoding fails gracefully rather than ending in std::terminate.
- Whether clang emits calls to these exact handler names under the given flags. For example, build settings such as -fno-sanitize-recover or trap mode could select other handlers, and the material does not cover this.
- Why the per-major facts report only a partial line match of the patched region at the latest tags.
- Why the bulletin rates a DoS as Critical.
- Whether host_linux builds (static_libs libcompiler_rt-extras) behave the same with the replacement runtime.