CVE-2026-0042 AI-generated analysis
platform/external/dng_sdk: the libdng_sdk build (Android.bp) and a new ubsan-replacement runtime. The test points to the ImageDecoder DNG path as the consumer.
Rebuilds libdng_sdk (platform/external/dng_sdk) so that UBSan integer-overflow detections throw a C++ std::runtime_error instead of going to the ubsan minimal runtime, which does a hard abort.
Root cause
libdng_sdk-defaults (Android.bp lines 144-149) enables sanitize.misc_undefined for unsigned-integer-overflow and signed-integer-overflow. With the stock Soong configuration, this uses the ubsan minimal runtime, whose handlers abort on any detected overflow (general platform knowledge). libdng_sdk is built with rtti and -fexceptions (lines 141-142). So an input that triggered an arithmetic overflow anywhere in the instrumented library aborted the process. The commit message names the abort as the problem: 'C++ exceptions are enabled in this library and are a much, much better solution for ubsan errors than a hard abort is.'
How the fix works
- Android.bp, cc_library libdng_sdk: adds `sanitize: { never: true }`. The comment says this disables the ubsan_minimal runtime so the module can inject its own, and that it is a workaround because Soong has no specific flag for this.
- Android.bp, cc_library libdng_sdk: replaces `cflags: ["-DqDNGValidate=0"]` with cflags that keep -DqDNGValidate=0 and add `-fsanitize=signed-integer-overflow,unsigned-integer-overflow` (turning the instrumentation back on by hand) and `-fno-sanitize-link-runtime`, so no sanitizer runtime is linked.
- Android.bp, cc_library libdng_sdk: adds `ubsan-replacement/ubsan_throwing_runtime.cpp` to srcs. This file provides the handler symbols.
- ubsan-replacement/ubsan_throwing_runtime.cpp: defines five extern "C" functions with hidden visibility: __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow. Each one does `throw std::runtime_error("ubsan: <kind>")`. Because the library is built with -fexceptions, the throw unwinds out of the overflowing code to the nearest catch instead of aborting.
- OWNERS: metadata only (bug component, an include of the frameworks/base graphics OWNERS file, LAST_RESORT_SUGGESTION owners). It has no functional effect.
- Test: atest ImageDecoderTest#testInterestingDngs. This points to the ImageDecoder DNG path as the validated consumer.
Completeness
- The fix changes only the failure mode. It does not correct any specific overflowing arithmetic in the DNG SDK sources. Overflows caught by the five provided handlers now throw instead of aborting.
- Only the `libdng_sdk` cc_library is changed. `libdng_sdk-defaults` still carries sanitize.misc_undefined (context lines 144-149), so any other module that uses those defaults would not get this change. No such module is shown in the material.
- The material does not show whether every caller of libdng_sdk catches std::runtime_error (or uses catch(...)). An uncaught exception would still terminate the process. The test only exercises the ImageDecoder path.
- `sanitize: { never: true }` also removes any other sanitizer Soong would otherwise apply to this module (general platform knowledge). The diff adds back only the two integer-overflow checks.
Behavior changes
- When libdng_sdk detects an integer overflow, the handler no longer aborts. It throws a std::runtime_error with the message 'ubsan: add-overflow', 'sub-overflow', 'mul-overflow', 'negate-overflow' or 'divrem-overflow', which unwinds to the nearest handler. If no caller catches it, the process still terminates.
- libdng_sdk no longer links a sanitizer runtime (-fno-sanitize-link-runtime). The handler symbols are defined inside the library with hidden visibility.
- libdng_sdk is built with sanitize.never, so Soong applies none of its own sanitizer configuration to this module. Integer-overflow instrumentation is kept through explicit cflags.
Per major
- Android 14: Same fix: platform/external/dng_sdk 42e65547eb33 in android-security-14.0.0_r28, a cherry-pick. The Android.bp hunk (1978b39..3d95a7b) is identical to the other branches and the OWNERS change is adapted to this branch. The code context at android-security-14.0.0_r29 shows the full change (sanitize never, cflags, srcs, runtime file), even though the per-major fact says 3/5 lines of the patched region are present.
- Android 15: Same fix: platform/external/dng_sdk 1ec41401b3d4 in android-security-15.0.0_r16. The Android.bp hunk and runtime file are identical. Only the OWNERS diff differs, because the branch had different prior content; it has no functional effect.
- Android 16: Same fix: platform/external/dng_sdk 74a5a91d169a in android-security-16.0.0_r7. The Android.bp hunk and runtime file are identical. The OWNERS diff is adapted to this branch's prior content.
- Android 17: Same fix: platform/external/dng_sdk 7937f2f835ab in android-17.0.0_r1 (base tag). The commit title carries RESTRICT AUTOMERGE. The Android.bp hunk and runtime file are identical.
Unknowns
- Which DNG SDK arithmetic sites overflow for the seven linked bugs. The diff contains no source changes to the parser.
- Which handler symbols the compiler actually emits under these flags, and whether the five provided handlers cover all of them.
- Which processes host libdng_sdk, and whether they all catch std::runtime_error. Only the ImageDecoder test is referenced.
- Why the bulletin rates this DoS as Critical (for example, which process crashes). The material does not say.
- Whether any other cc module in external/dng_sdk uses libdng_sdk-defaults and still uses the aborting minimal runtime.
- Whether the defaults on Android 15, 16 and 17 also carry rtti and -fexceptions. Only the Android 14 context is shown.