CVE-2026-0052 AI-generated analysis
platform/external/dng_sdk, libdng_sdk build configuration (Android.bp) and new ubsan-replacement runtime
Rebuilds libdng_sdk so that UBSan integer-overflow detections throw a C++ std::runtime_error from a handler runtime inside the project, instead of aborting the process through the default ubsan-minimal runtime.
Root cause
The module just before libdng_sdk in Android.bp (lines 138-163, labelled cc_library in the context; presumably libdng_sdk-defaults, which libdng_sdk uses as defaults) enables sanitize.misc_undefined for unsigned-integer-overflow and signed-integer-overflow (lines 144-149). According to the commit message and the fix comment, that configuration links the ubsan-minimal runtime, which does a hard abort on a detected overflow. The commit message says C++ exceptions are enabled in this library (rtti: true and cppflags -fexceptions at lines 141-142), but the abort leaves no chance for exception-based error handling. Integer overflow in dng_sdk's instrumented arithmetic therefore terminates the hosting process. The commit lists seven bug IDs, which fits several distinct overflow sites that all share this abort behavior. Those sites are not changed or shown.
How the fix works
- Android.bp, cc_library libdng_sdk: adds sanitize { never: true }. The in-file comment says this disables the ubsan_minimal runtime so that a custom runtime can be injected.
- Android.bp, cc_library libdng_sdk: re-enables the instrumentation by hand with the cflags -fsanitize=signed-integer-overflow,unsigned-integer-overflow, and adds -fno-sanitize-link-runtime so that no sanitizer runtime is linked. The existing -DqDNGValidate=0 is kept.
- Android.bp, cc_library libdng_sdk: adds ubsan-replacement/ubsan_throwing_runtime.cpp to srcs, so the library provides its own handler symbols.
- ubsan-replacement/ubsan_throwing_runtime.cpp (new): defines __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow as extern "C" with hidden visibility. Each one throws std::runtime_error with a short message instead of aborting.
- OWNERS: metadata-only change (bug component, include of the frameworks/base graphics OWNERS, LAST_RESORT_SUGGESTION markers). Not part of the security fix.
Completeness
- The fix changes the failure mode across the whole library: a detected signed or unsigned add/sub/mul/negate/divrem overflow in libdng_sdk now throws instead of aborting. It does not fix any of the underlying overflow computations.
- Only five overflow handlers are provided, matching the two integer-overflow sanitizer classes that the new cflags enable.
- The handlers have hidden visibility and are compiled only into libdng_sdk. The misc_undefined setting in the preceding module block (lines 144-149) is unchanged, so any other module that uses those defaults (none shown in the material) is not covered by this change.
- The material does not show whether dng_sdk itself or its callers catch the thrown std::runtime_error. If nothing catches it, the result is still a crash via std::terminate. The Test line (ImageDecoderTest#testInterestingDngs) shows that Google tested the ImageDecoder DNG path.
Behavior changes
- Detected integer overflows inside libdng_sdk now raise std::runtime_error with messages such as "ubsan: add-overflow", "ubsan: sub-overflow", "ubsan: mul-overflow", "ubsan: negate-overflow" and "ubsan: divrem-overflow" instead of aborting the process.
- libdng_sdk no longer links the ubsan-minimal runtime. Signed and unsigned integer-overflow instrumentation is still enabled through cflags.
- Malformed DNG inputs that previously crashed the hosting process should now reach the caller as an error, provided the exception is caught upstream.
Per major
- Android 14: Same fix: commit 42e65547eb33 in android-security-14.0.0_r28. The Android.bp and runtime-file diff matches 15 and 16 (same Android.bp blob ids 1978b39..3d95a7b); only the OWNERS hunk differs. The code context at android-security-14.0.0_r29 shows the sanitize block, the cflags and the srcs entry. The resolver reports 3/5 lines of the patched region present.
- Android 15: Same fix: commit 1ec41401b3d4 in android-security-15.0.0_r16, with an identical Android.bp and runtime diff. Only the OWNERS hunk differs.
- Android 16: Same fix: commit 74a5a91d169a in android-security-16.0.0_r7, with an identical Android.bp and runtime diff. Only the OWNERS hunk differs.
- Android 17: Adapted fix: commit 81ded662eee0 (one of the Cherrypick-From sources, resolved by related bug) in android-17.0.0_r1. The runtime file is the same. In Android.bp, ubsan_throwing_runtime.cpp is added to the end of an existing srcs list (hunk at line 220) instead of in a new srcs block. No OWNERS change is included.
Unknowns
- Which dng_sdk source locations overflow for the seven referenced bugs. The diff changes no parsing code.
- Whether dng_sdk or its callers (for example the Skia DNG codec or ImageDecoder) catch std::runtime_error, so that the new exception becomes a clean decode failure rather than std::terminate.
- Which processes load libdng_sdk and are therefore the ones whose crash the bulletin rates as a Critical DoS.
- The name of the module block at lines 138-163 and whether other modules use it as defaults and still abort on overflow.
- Which UBSan handler variants the compiler emits under these flags (recoverable or abort).