CVE-2026-0051 AI-generated analysis
platform/external/dng_sdk, libdng_sdk build configuration (Android.bp) and new ubsan-replacement runtime
Rebuilds libdng_sdk so that the integer-overflow UBSan checks call a library-private runtime that throws std::runtime_error instead of the ubsan-minimal runtime that aborts the process, turning overflow detections on malformed DNG input into recoverable C++ exceptions.
Root cause
libdng_sdk-defaults (Android.bp) enables sanitize.misc_undefined for "unsigned-integer-overflow" and "signed-integer-overflow". With Soong's default handling this links the ubsan-minimal runtime, whose handlers abort the process when an overflow is detected (the commit message calls this a hard abort). A DNG file that makes any instrumented add/sub/mul/negate/div operation in the DNG SDK overflow therefore kills the process decoding the image, even though the library is built with rtti and -fexceptions and could otherwise recover via exceptions. The arithmetic itself is not changed by this fix; the material does not identify the specific overflowing sites (seven bug IDs are listed).
How the fix works
- Android.bp, cc_library libdng_sdk: adds sanitize: { never: true } to stop Soong from applying its own sanitizer configuration (and thus from linking the ubsan-minimal runtime) to this module, overriding the misc_undefined list inherited from libdng_sdk-defaults.
- Android.bp, cc_library libdng_sdk: replaces cflags ["-DqDNGValidate=0"] with cflags that keep -DqDNGValidate=0 and add "-fsanitize=signed-integer-overflow,unsigned-integer-overflow" so the overflow instrumentation is still compiled in, plus "-fno-sanitize-link-runtime" so no compiler-rt UBSan runtime is linked.
- Android.bp, cc_library libdng_sdk: adds srcs ubsan-replacement/ubsan_throwing_runtime.cpp so the handler symbols the instrumentation calls are satisfied by the library itself.
- ubsan-replacement/ubsan_throwing_runtime.cpp: defines extern "C" hidden-visibility __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow, each of which throws std::runtime_error with a message naming the overflow kind. Because libdng_sdk-defaults already sets rtti: true and cppflags -fexceptions, the throw unwinds through the DNG SDK instead of aborting.
- OWNERS: ownership metadata update only, no functional effect.
Completeness
- Covers the two sanitizers enabled by the new -fsanitize flag (signed and unsigned integer overflow) and provides five non-abort handler entry points for those checks; no other UBSan check is enabled on libdng_sdk by the module's own configuration.
- Does not fix any of the underlying overflowing arithmetic in the DNG SDK sources; it changes the failure mode from abort to exception. Whether every caller of libdng_sdk catches std::runtime_error (as opposed to the SDK's own exception types) is not shown in the material.
- Only the libdng_sdk cc_library is changed. libdng_sdk-defaults still carries sanitize.misc_undefined, so any other module built from those defaults keeps the default Soong UBSan runtime behaviour; the material does not list such modules.
- No _abort handler variants are defined; they would be needed if non-recoverable sanitizer mode were ever enabled for this module.
- The handlers take no parameters and ignore the diagnostic data clang passes, so no source location is reported; this is a diagnostics limitation, not a security gap.
Behavior changes
- An integer overflow detected inside libdng_sdk now throws std::runtime_error ("ubsan: add-overflow", "sub-overflow", "mul-overflow", "negate-overflow" or "divrem-overflow") instead of aborting the process.
- libdng_sdk no longer links the compiler-rt ubsan-minimal runtime; the handler symbols are provided internally with hidden visibility, so they are not exported from the shared library.
- Soong sanitizer processing is disabled for libdng_sdk (sanitize.never: true); sanitizer coverage is now controlled solely by the explicit cflags.
Per major
- Android 14: same fix: commit 42e65547eb33 in android-security-14.0.0_r28, identical Android.bp hunk and new ubsan_throwing_runtime.cpp; OWNERS diff differs only in the pre-existing content. Per-major facts: 3/5 lines of the patched region present at android-security-14.0.0_r29; the r29 code context shows the new sanitize/cflags/srcs block and runtime file.
- Android 15: same fix: commit 1ec41401b3d4 in android-security-15.0.0_r16, identical Android.bp hunk and new runtime file; per-major facts report 3/4 lines of the patched region present at android-security-15.0.0_r17.
- Android 16: same fix: commit 74a5a91d169a in android-security-16.0.0_r7, identical Android.bp hunk and new runtime file; per-major facts report 3/5 lines of the patched region present at android-security-16.0.0_r8.
- Android 17: same fix: commit 7937f2f835ab (RESTRICT AUTOMERGE) in android-17.0.0_r1 (resolved via base), identical Android.bp hunk and new runtime file; per-major facts report 3/5 lines of the patched region present at android-security-17.0.0_r1.
Unknowns
- The specific overflowing expressions in the DNG SDK behind the seven referenced bug IDs are not shown.
- Which processes host libdng_sdk decoding of untrusted DNGs (and so which process was crashing) is not shown beyond the ImageDecoder test reference.
- Whether all callers of libdng_sdk catch std::runtime_error, or whether an uncaught exception could still terminate a caller, is not shown.
- Why the bulletin rates a DoS as Critical is not explained in the material.
- Why the per-major region check reports only partial line matches (3/5, 3/4) at the latest tags is not explained.