CVE-2026-0044 AI-generated analysis
platform/external/dng_sdk, libdng_sdk build configuration (Android.bp) and sanitizer runtime
Rebuilds libdng_sdk so that integer-overflow sanitizer hits throw a C++ exception (handlers in the new file ubsan-replacement/ubsan_throwing_runtime.cpp) instead of going to the ubsan minimal runtime, which aborts the process.
Root cause
libdng_sdk-defaults compiles the library with sanitize.misc_undefined = [unsigned-integer-overflow, signed-integer-overflow] (Android.bp lines 144-149). Under Soong's handling, detected overflows go to the ubsan minimal runtime, which does a hard abort. On input that drives DNG SDK arithmetic into overflow, the host process was therefore aborted, even though the library is built with -fexceptions and rtti. The commit message says C++ exceptions are enabled in this library and are 'a much, much better solution for ubsan errors than a hard abort'. The commit lists seven Bug IDs; their individual content is not shown.
How the fix works
- Android.bp, cc_library libdng_sdk: adds sanitize { never: true }. Per the inline comment, this disables the ubsan_minimal runtime so the library can supply its own handlers.
- Android.bp, cc_library libdng_sdk: turns the checks back on through cflags -fsanitize=signed-integer-overflow,unsigned-integer-overflow and adds -fno-sanitize-link-runtime. The overflow checks are still emitted, but no sanitizer runtime is linked. -DqDNGValidate=0 is kept.
- Android.bp, cc_library libdng_sdk: adds ubsan-replacement/ubsan_throwing_runtime.cpp to srcs.
- ubsan-replacement/ubsan_throwing_runtime.cpp: defines hidden-visibility extern "C" handlers __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow. Each one throws std::runtime_error with a descriptive message. Because the library is compiled with -fexceptions, the exception can unwind to a catch handler instead of aborting the process.
- OWNERS: ownership metadata only, no functional effect.
Completeness
- The fix does not correct any of the overflowing arithmetic in the DNG SDK sources. It changes only how a detected overflow is reported (exception instead of abort). Handling sits at the sanitizer handler level, so it applies the same way to every instrumented overflow site in libdng_sdk.
- The module provides only the five handlers that correspond to the enabled checks (add, sub, mul, negate and divrem overflow).
- The handlers have hidden visibility and are compiled only into the libdng_sdk module. Any other module that reuses libdng_sdk-defaults (which still carries sanitize.misc_undefined) would keep the abort behavior. The material does not show whether such modules exist.
- The material does not show whether every code path that can hit an overflow sits inside a try/catch that handles std::runtime_error. An uncaught exception would still terminate the process.
- host_linux still links libcompiler_rt-extras statically (Android.bp line 196). The material does not show whether this interacts with the replacement handlers on host builds.
Behavior changes
- An integer overflow detected inside libdng_sdk now throws std::runtime_error ("ubsan: add-overflow" and so on) instead of aborting the process.
- libdng_sdk is no longer linked against Soong's ubsan minimal runtime. The signed and unsigned integer-overflow checks are still compiled in through explicit cflags.
- The commit's test is atest ImageDecoderTest#testInterestingDngs. The material does not show how callers see the new exception.
Per major
- Android 14: Same fix: 42e65547eb33 in android-security-14.0.0_r28, a cherry-pick of three internal commits. The code context at android-security-14.0.0_r29 shows the full change in place (sanitize.never, cflags, srcs and the new file).
- Android 15: Same fix: 1ec41401b3d4 in android-security-15.0.0_r16. Android.bp and the new runtime file are identical to 14 (index 1978b39..3d95a7b and aeaad0c). Only the OWNERS diff differs.
- Android 16: Same fix: 74a5a91d169a in android-security-16.0.0_r7. Android.bp and the new file are identical to 14. The OWNERS diff differs only in the prior content.
- Android 17: Same fix: 7937f2f835ab in android-17.0.0_r1 (subject tagged RESTRICT AUTOMERGE). Android.bp and the new file are identical to 14.
Unknowns
- Which DNG SDK functions contain the overflowing arithmetic. Seven bug IDs are referenced, but the commit includes no source-level fix.
- Whether all libdng_sdk entry points used by the platform catch std::runtime_error, or whether some paths would still terminate through an uncaught exception.
- Whether other modules build from libdng_sdk-defaults and so keep the aborting minimal runtime.
- Why the bulletin rates a DoS as Critical. The material gives no detail on the affected process or on remote reachability.