CVE-2026-0067 AI-generated analysis
platform/external/dng_sdk, libdng_sdk build (Android.bp) and UBSan runtime replacement
In external/dng_sdk, libdng_sdk stops using the Soong-managed ubsan_minimal runtime and instead enables the signed/unsigned integer-overflow sanitizers via cflags with -fno-sanitize-link-runtime, plus a bundled ubsan_throwing_runtime.cpp whose __ubsan_handle_*_overflow handlers throw std::runtime_error, so detected overflows become C++ exceptions rather than a hard abort.
Root cause
libdng_sdk-defaults enables sanitize.misc_undefined ["unsigned-integer-overflow", "signed-integer-overflow"] (Android.bp lines 144-149), and the libdng_sdk module used the ubsan_minimal runtime, which the commit message describes as a hard abort. The library is built with -fexceptions and rtti: true (lines 141-142), and the commit notes that C++ exceptions are enabled, but a detected overflow aborted the process instead. The commit lists seven bug IDs. The fix does not change any arithmetic site; it changes what happens when an overflow check fires.
How the fix works
- Android.bp, cc_library libdng_sdk: adds sanitize: { never: true }, which the inline comment says is meant to disable the ubsan_minimal runtime so a custom one can be injected.
- Android.bp, cc_library libdng_sdk: cflags gain -fsanitize=signed-integer-overflow,unsigned-integer-overflow to enable the same two overflow checks directly, plus -fno-sanitize-link-runtime so no sanitizer runtime is linked.
- Android.bp, cc_library libdng_sdk: srcs gains ubsan-replacement/ubsan_throwing_runtime.cpp.
- ubsan-replacement/ubsan_throwing_runtime.cpp: defines five extern "C" hidden-visibility handlers (__ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow, __ubsan_handle_divrem_overflow), each of which throws std::runtime_error("ubsan: <kind>-overflow").
- OWNERS: metadata only (bug component, include of the frameworks/base graphics OWNERS file, owner annotations); no functional effect.
Completeness
- The change works at the runtime-handler level rather than per expression, so it applies to any overflow check in libdng_sdk that resolves to one of the five defined handlers.
- It does not fix the underlying arithmetic: the overflow is still detected, and it is now reported by an exception. Whether the eventual catch site handles std::runtime_error is not visible in the material.
- sanitize.never: true turns off all Soong-managed sanitizers for libdng_sdk, not only the two overflow checks; only the explicitly listed -fsanitize flags remain (general platform knowledge).
- An exception thrown from a context that cannot unwind (for example a noexcept function or a destructor) would still terminate the process; the diff does not audit for such contexts.
- libdng_sdk-defaults still lists misc_undefined (code context lines 144-149). Only the libdng_sdk module is changed; whether other modules use those defaults is not shown.
Behavior changes
- Signed or unsigned integer overflow detected inside libdng_sdk now throws std::runtime_error("ubsan: <kind>-overflow") instead of aborting.
- libdng_sdk no longer uses the ubsan_minimal runtime; the five __ubsan_handle_*_overflow symbols are provided inside the module with hidden visibility.
- Other Soong-applied sanitizers for libdng_sdk are disabled by sanitize.never: true (general platform knowledge).
Per major
- Android 14: Same fix: commit 42e65547eb33 in android-security-14.0.0_r28 (linked by change_id I7b8414e4b5c2f2ca44f572fb72e625d1907f7902). The Android.bp hunk and the runtime file are identical to 15 and 16; the OWNERS diff differs only in its prior content. The code context at android-security-14.0.0_r29 shows the patched block, but the per-major facts report only 3 of 5 lines of the patched region matched.
- Android 15: Same fix: commit 1ec41401b3d4 in android-security-15.0.0_r16, with an identical Android.bp hunk and runtime file. 3 of 4 lines of the patched region matched at android-security-15.0.0_r17.
- Android 16: Same fix: commit 74a5a91d169a in android-security-16.0.0_r7, with an identical Android.bp hunk and runtime file. 3 of 5 lines of the patched region matched at android-security-16.0.0_r8.
- Android 17: Adapted fix: commit 81ded662eee0 in android-17.0.0_r1, resolved by related bug. It is the commit the others list as their first Cherrypick-From. Android.bp has a different layout there: the sanitize/cflags hunk is at line 105, and the new source is added to the existing explicit srcs list (around line 220). OWNERS is not touched, and ubsan_throwing_runtime.cpp is the same. 5 of 6 lines of the patched region matched at android-security-17.0.0_r1.
Unknowns
- Which expression(s) in dng_sdk overflow; the seven referenced bugs are not described in the material.
- Where the thrown std::runtime_error is caught, and therefore whether the result is a clean decode failure in all callers.
- Whether the five defined handlers cover every handler symbol the compiler references under this flag set (for example _abort or other variants); this is not shown in the material.
- Which processes host libdng_sdk on each release, and therefore which process the pre-fix abort brought down.
- Why the per-major facts report only partial matches of the patched region in the latest security tags.