CVE-2026-0043 AI-generated analysis
platform/external/dng_sdk, libdng_sdk build configuration (DNG image parsing library; the commit's test is ImageDecoderTest#testInterestingDngs)
Rebuilds libdng_sdk with Soong sanitizer integration disabled (sanitize.never), adds explicit -fsanitize=signed-integer-overflow,unsigned-integer-overflow plus -fno-sanitize-link-runtime, and links a new in-tree UBSan handler file (ubsan-replacement/ubsan_throwing_runtime.cpp). Its overflow handlers throw std::runtime_error instead of the ubsan-minimal hard abort.
Root cause
libdng_sdk-defaults (Android.bp lines 144-149 in context) enables sanitize.misc_undefined for unsigned-integer-overflow and signed-integer-overflow, and the libdng_sdk cc_library inherited it. Per the commit message and the Android.bp comment, the ubsan-minimal runtime was used, so an integer overflow detected in the library caused a hard abort rather than a recoverable error. This was the case even though the library is built with rtti: true and -fexceptions (context lines 141-142) and C++ exceptions are enabled. Seven bug IDs are attached to the commit. The specific arithmetic sites are not in the material.
How the fix works
- Android.bp :: cc_library libdng_sdk: adds sanitize { never: true } to turn off Soong's sanitizer handling (and its ubsan_minimal runtime) for this module. The comment says this is a workaround because Soong has no flag that only drops the runtime.
- Android.bp :: cc_library libdng_sdk: adds cflags -fsanitize=signed-integer-overflow,unsigned-integer-overflow so the overflow instrumentation is still emitted, and -fno-sanitize-link-runtime so the sanitizer runtime is not linked.
- Android.bp :: cc_library libdng_sdk: adds ubsan-replacement/ubsan_throwing_runtime.cpp to srcs so the handler symbols are provided inside libdng_sdk.
- ubsan-replacement/ubsan_throwing_runtime.cpp: defines extern "C" hidden-visibility __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow. Each one throws std::runtime_error("ubsan: <kind>"), so a detected overflow becomes a C++ exception instead of an abort.
- OWNERS: ownership metadata update only, no functional effect.
Completeness
- Covers only the five integer-overflow handler kinds (add, sub, mul, negate, divrem). Only signed-integer-overflow and unsigned-integer-overflow are enabled, which matches what the defaults enabled before. No other UBSan checks are enabled or handled.
- The underlying arithmetic in dng_sdk is not changed. The fix turns each detected overflow into an exception. The material does not show whether each caller of libdng_sdk catches std::runtime_error, and an uncaught exception would still terminate the process.
- The override applies only to the libdng_sdk cc_library. libdng_sdk-defaults still carries sanitize.misc_undefined, so any other module built from those defaults (none shown in the material) is not covered by this change.
- The handlers have hidden visibility, so they only resolve references from within libdng_sdk. The host_linux static_libs libcompiler_rt-extras line is unchanged.
Behavior changes
- An integer overflow detected in libdng_sdk now throws std::runtime_error with the message "ubsan: add-overflow", "ubsan: sub-overflow", "ubsan: mul-overflow", "ubsan: negate-overflow" or "ubsan: divrem-overflow" instead of aborting the process.
- libdng_sdk no longer uses the ubsan_minimal runtime. The instrumentation is still present through the explicit -fsanitize cflags.
- The replacement handlers take no arguments and throw a fixed message per overflow kind.
Per major
- Android 14: same fix: 42e65547eb33 in android-security-14.0.0_r28, with the same Android.bp and ubsan_throwing_runtime.cpp hunks (the OWNERS hunk differs). The code context at android-security-14.0.0_r29 shows the new Android.bp block and runtime file. The resolver reports 3/5 lines of the patched region present at r29.
- Android 15: same fix: 1ec41401b3d4 in android-security-15.0.0_r16, with the same Android.bp and runtime hunks and an OWNERS hunk adapted to that branch's prior content. The resolver reports 3/4 lines present at r17.
- Android 16: same fix: 74a5a91d169a in android-security-16.0.0_r7, with the same Android.bp and runtime hunks and an OWNERS hunk adapted to that branch's prior content. The resolver reports 3/5 lines present at r8.
- Android 17: same fix: 7937f2f835ab in android-17.0.0_r1 (base), marked RESTRICT AUTOMERGE, with the same Android.bp and runtime hunks. The resolver reports 3/5 lines present at android-security-17.0.0_r1.
Unknowns
- The material does not show the specific overflow sites in dng_sdk behind the seven bug IDs, nor why the bulletin rates an abort-to-exception change as Critical EoP.
- Whether callers of libdng_sdk (e.g. the ImageDecoder DNG path) catch std::runtime_error is not shown.
- Whether any other module uses libdng_sdk-defaults is not shown.
- Whether the compiler emits calls to the recoverable (non-_abort) handler names under these cflags is not shown in the material.
- Why the resolver reports only partial presence (3/5 or 3/4 lines) of the patched region in the latest tags is not explained.