CVE-2026-0080 AI-generated analysis

platform/external/dng_sdk, libdng_sdk build (Android.bp) and sanitizer runtime

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

Rebuilds libdng_sdk so that UBSan integer-overflow detections throw a C++ std::runtime_error (via a bundled replacement runtime in ubsan-replacement/ubsan_throwing_runtime.cpp) instead of aborting the process through the ubsan-minimal runtime.

Root cause

libdng_sdk-defaults enables sanitize.misc_undefined for unsigned-integer-overflow and signed-integer-overflow, which instruments the arithmetic and uses the ubsan-minimal runtime. Per the commit title and Android.bp comment, a detected overflow led to a hard abort, even though the library is built with -fexceptions and rtti. A DNG input that causes an instrumented overflow inside libdng_sdk could therefore abort the hosting process. The commit lists seven bug IDs; their details are not shown.

How the fix works

• Android.bp, cc_library libdng_sdk: adds sanitize { never: true } so Soong no longer applies its sanitizer configuration or the ubsan_minimal runtime for this module. The comment in the diff describes this as a workaround because Soong has no dedicated flag.
• Android.bp, cc_library libdng_sdk: adds cflags -fsanitize=signed-integer-overflow,unsigned-integer-overflow to keep the overflow instrumentation, plus -fno-sanitize-link-runtime so no sanitizer runtime is linked. -DqDNGValidate=0 is kept.
• Android.bp, cc_library libdng_sdk: adds ubsan-replacement/ubsan_throwing_runtime.cpp to srcs. On Android 14/15/16 this is a new srcs block; on Android 17 the file is appended to the existing source list.
• ubsan-replacement/ubsan_throwing_runtime.cpp (new): defines hidden-visibility extern "C" __ubsan_handle_add_overflow, __ubsan_handle_sub_overflow, __ubsan_handle_mul_overflow, __ubsan_handle_negate_overflow and __ubsan_handle_divrem_overflow. Each one throws std::runtime_error with a short message. The module is compiled with cppflags -fexceptions (libdng_sdk-defaults, Android.bp line 142), so the throw can unwind as an exception. Where it is caught is not shown.
• OWNERS (14/15/16 only): ownership metadata update with no functional effect.

Completeness

• The fix does not correct any specific overflowing computation. It changes the consequence of each detected signed/unsigned overflow in libdng_sdk from an abort to a thrown exception. The overflow sites remain in the code.
• Only five handlers are provided (add, sub, mul, negate, divrem overflow), matching the two overflow sanitizers enabled by the new -fsanitize flag.
• The thrown type is std::runtime_error, not a dng_sdk exception type. The material does not show whether every caller path catches std::exception (or uses catch(...)).
• The change is scoped to the libdng_sdk cc_library. libdng_sdk-defaults still carries sanitize.misc_undefined for both overflow checks (Android.bp lines 144-149). Whether other modules use those defaults is not shown.
• The handlers are declared without parameters, so the diagnostic data the compiler passes is ignored and the overflow location is not logged.

Behavior changes

• On an instrumented integer overflow inside libdng_sdk, a std::runtime_error ("ubsan: add-overflow" etc.) is thrown instead of the process aborting. The outcome depends on whether a caller catches it.
• Build-level: libdng_sdk is no longer sanitized through Soong's sanitize property. The instrumentation now comes from explicit cflags and the handlers from an in-tree source file.

Per major

• Android 14: same fix: platform/external/dng_sdk 42e65547eb33 in android-security-14.0.0_r28 (cherry-pick, matched by change_id). Android.bp changes and new runtime file are identical, plus an OWNERS update. Code context at android-security-14.0.0_r29 shows the patched Android.bp block and runtime file, while the resolver reports 3/5 lines of the patched region present.
• Android 15: same fix: 1ec41401b3d4 in android-security-15.0.0_r16 (change_id). Android.bp and runtime file are identical to 14; the OWNERS hunk differs only in the pre-existing content. Resolver: 3/4 lines present at r17.
• Android 16: same fix: 74a5a91d169a in android-security-16.0.0_r7 (change_id). Android.bp and runtime file are identical to 14; the OWNERS hunk differs only in pre-existing content. Resolver: 3/5 lines present at r8.
• Android 17: adapted fix: 81ded662eee0 in android-17.0.0_r1 (matched by related_bug; listed as a Cherrypick-From source). The Android.bp layout differs: the hunk is at line 105 and the new source is appended to the existing srcs list instead of a new srcs block. There is no OWNERS change, and the runtime file is identical. Resolver: 5/6 lines present.

Unknowns

• Which arithmetic sites in dng_sdk overflow for the inputs tracked by the seven listed bugs; the diff touches no parser code.
• Where up the call stack the std::runtime_error is caught, and whether all consumers catch std::exception/catch(...) rather than only dng_sdk-specific exception types.
• Whether other modules consume libdng_sdk-defaults and therefore still abort on overflow.
• How the build behaves if only some of the Android.bp pieces are applied.
• The meaning of the resolver's partial line counts (e.g. 3/5 on Android 14) given that the code context shows the patched region.

Back to June 2026 · Findings