CVE-2026-0079 AI-generated analysis
platform/external/dng_sdk, libdng_sdk build (Android.bp) and new ubsan-replacement runtime
libdng_sdk stops linking the aborting ubsan-minimal runtime and instead ships its own hidden __ubsan_handle_*_overflow handlers that throw std::runtime_error, so integer overflows detected in the library become C++ exceptions rather than a process abort.
Root cause
libdng_sdk-defaults in Android.bp enables sanitize.misc_undefined ["unsigned-integer-overflow", "signed-integer-overflow"]. Per the comment added in the fix, Soong's handling links the ubsan-minimal runtime, which does a hard abort on a detected error. So any signed or unsigned integer overflow in libdng_sdk arithmetic while processing a DNG file killed the hosting process. The commit references seven bugs. The library is built with rtti: true and -fexceptions, and the commit message says exceptions are "a much, much better solution for ubsan errors than a hard abort is".
How the fix works
- Android.bp, cc_library libdng_sdk: adds sanitize { never: true } so Soong does not apply its sanitizer configuration or link the ubsan-minimal runtime for this module. The comment notes that Soong has no dedicated flag for this.
- Android.bp, cc_library libdng_sdk: re-enables instrumentation explicitly with the cflags -fsanitize=signed-integer-overflow,unsigned-integer-overflow and adds -fno-sanitize-link-runtime, so overflow checks are still emitted but no sanitizer runtime is linked. -DqDNGValidate=0 is kept.
- Android.bp, cc_library libdng_sdk: adds ubsan-replacement/ubsan_throwing_runtime.cpp to srcs. On 14/15/16 this is a new srcs property; on 17 the file is appended to the existing srcs list.
- ubsan-replacement/ubsan_throwing_runtime.cpp: defines extern "C" hidden-visibility __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow. Each throws std::runtime_error with a descriptive message, so a detected overflow unwinds as a C++ exception instead of aborting.
- OWNERS (14/15/16 only): adds a bug component line and includes the frameworks/base graphics OWNERS; not security relevant.
Completeness
- Defines five handlers (add, sub, mul, negate and divrem overflow). Only signed-integer-overflow and unsigned-integer-overflow are instrumented, which matches what libdng_sdk-defaults enabled before. The material does not show whether the compiler can emit any other handler for these checks.
- The fix does not correct any specific overflowing computation in the dng_sdk sources. It changes the failure mode generically from abort to exception, and the arithmetic sites behind the seven referenced bugs are not changed by this commit.
- The handlers have hidden visibility and are compiled only into libdng_sdk. Other modules using libdng_sdk-defaults, if any, keep the default Soong sanitizer behaviour.
- The material does not show whether every exception thrown from a handler is caught before it reaches a caller boundary. An uncaught exception would still terminate the process.
- Unsigned-integer-overflow now throws at sites that rely on intentional wraparound. Those sites already aborted in the pre-fix build, so this adds no new failure surface compared with that build.
Behavior changes
- Integer overflow detected by the sanitizer in libdng_sdk now throws std::runtime_error ("ubsan: add-overflow" etc.) instead of aborting the process.
- libdng_sdk no longer links the ubsan-minimal runtime. For this module, sanitizer instrumentation is driven by explicit cflags rather than Soong's sanitize settings.
- If a caller catches the exception, a malformed input that previously aborted the process becomes a recoverable failure. The material does not show any caller's exception handling.
Per major
- Android 14: same fix: 42e65547eb33 in android-security-14.0.0_r28 (Android.bp sanitize/cflags/srcs, new ubsan_throwing_runtime.cpp, OWNERS). The code context at android-security-14.0.0_r29 shows the Android.bp and runtime changes, but the per-major facts report only 3/5 lines of the patched region present there.
- Android 15: same fix: 1ec41401b3d4 in android-security-15.0.0_r16. Android.bp and runtime file are identical; the OWNERS hunk differs only in its starting content. Per-major facts: 3/4 lines of the patched region present at android-security-15.0.0_r17.
- Android 16: same fix: 74a5a91d169a in android-security-16.0.0_r7. Android.bp and runtime file are identical; the OWNERS hunk differs only in its starting content. Per-major facts: 3/5 lines present at android-security-16.0.0_r8.
- Android 17: adapted fix: 81ded662eee0 in android-17.0.0_r1 (one of the Cherrypick-From originals; matched to the CVE by related bug). Same sanitize/cflags change and identical runtime file, but ubsan_throwing_runtime.cpp is appended to the existing srcs list in the libdng_sdk cc_library, and there is no OWNERS change.
Unknowns
- Which specific arithmetic sites in the dng_sdk sources overflowed (the seven referenced bugs are not described).
- Where in the Android decode stack the thrown std::runtime_error is caught, and whether all libdng_sdk entry points are wrapped in a catch.
- Whether the compiler can emit handler symbols beyond the five defined, and whether the parameterless replacement handlers are compatible with the arguments the compiler passes at every call site.
- Why the per-major facts report only partial presence of the patched region in the latest security tags (for example 3/5 lines on 14).