CVE-2026-0085 AI-generated analysis

platform/packages/providers/ContactsProvider, DataRowHandler (data row size enforcement)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (2 corrections). Verify against the commit before relying on it.

Makes DataRowHandler.applySimpleFieldMaxSize in ContactsProvider resolve the ContentValues key case-insensitively, so that a Data column supplied with mismatched case (e.g. "DaTa1") is still truncated to the simple-field maximum size instead of bypassing the check.

Root cause

applySimpleFieldMaxSize(ContentValues cv, String column) read the value with cv.getAsString(column), using the exact canonical column name. ContentValues keys are case-sensitive, so a caller that put the value under a differently cased key such as "daTa1" got v == null in the check, and the truncation to ContactsDatabaseHelper.getSimpleFieldMaxSize() was skipped. Per the added tests, a value under such a mismatched-case key is still applied to the DATA1 column, so the oversized value could be written to the data row. The bulletin classifies the impact as DoS (High).

How the fix works

• src/com/android/providers/contacts/DataRowHandler.java:applySimpleFieldMaxSize: instead of cv.getAsString(column), the code now calls the new findKey(cv, column) and reads cv.getAsString(key). If the value is longer than maxSize, it still logs and writes the truncated value with cv.put(column, ...) under the canonical column name.
• src/com/android/providers/contacts/DataRowHandler.java:findKey (new, private static): returns column if cv.containsKey(column). Otherwise it iterates cv.keySet() and returns the first key for which key.equalsIgnoreCase(column). If none matches, it returns column, so getAsString yields null and the method returns early as before.
• tests/src/com/android/providers/contacts/ContactsProvider2Test.java: adds three tests. testUpdateFailsWithOnlyCaseMismatchedColumn checks that an update with only a case-mismatched key is rejected (0 rows). testUpdateSucceedsWithAtLeastOneCaseSensitiveColumn checks that the mismatched key is applied when an exact-case key is also present. testCaseMismatchingFieldUpdatesAreTruncatedToMaxSize checks that the variants data1/daTa1/DATA1/Data1 all end up truncated to maxSize. The commit also removes the unused field mMockContactsDatabaseHelper.

Completeness

• The fix covers every call site of applySimpleFieldMaxSize, because the case-insensitive lookup is inside the helper itself; no call sites are changed.
• The oversized value under the mismatched-case key is not removed or rewritten; the truncated value is only added under the canonical column name. The new tests assert that the stored DATA1 value is the truncated one, so the canonical key takes effect in the tested update path, but the ContentValues still carries both keys after the call.
• findKey returns only the first case-insensitive match. If several differently cased variants of the same column were present, only one is inspected.
• testUpdateFailsWithOnlyCaseMismatchedColumn documents existing behavior (an update that specifies only a mismatched-case key is rejected); the source change in this diff does not introduce that behavior.
• Only size enforcement in DataRowHandler is addressed. The material does not show whether other ContentValues lookups in the provider use exact-case keys.

Behavior changes

• Values supplied under a differently cased Data column key are now truncated to getSimpleFieldMaxSize() and a 'Truncating field' warning is logged, where previously they were stored unmodified.
• After truncation, the ContentValues also contains the canonical column name (e.g. data1) with the truncated value.

Per major

• Android 14: same fix: adef234467ab in android-security-14.0.0_r28 (cherry-pick, Change-Id I91a2a7263f4017affcf5ed2f9da43bf2df9c1d8d); at android-security-14.0.0_r29, 7/8 lines of the patched region are present
• Android 15: same fix: 7d266fdeb2ec in android-security-15.0.0_r16, identical DataRowHandler.java hunk (b1295c1f..cdb4df79); at android-security-15.0.0_r17, 7/8 lines of the patched region are present
• Android 16: same fix: 0d925d762547 in android-security-16.0.0_r7, identical logic at a one-line different offset (b9becf16..6474c241); the tests carry @Test annotations; at android-security-16.0.0_r8, 7/8 lines of the patched region are present
• Android 17: same fix: d857ac867433 in android-17.0.0_r1 (base), identical hunk; at android-security-17.0.0_r1, 7/8 lines of the patched region are present

Unknowns

• The material does not show the call sites of applySimpleFieldMaxSize: which DataRowHandler subclasses or columns call it, or whether the insert path is covered in addition to update.
• The material does not describe the concrete DoS consequence of storing an oversized value beyond the bulletin type.
• The material does not show whether the canonical truncated value overrides the mismatched-case oversized value in all code paths; the tests only cover the structured-name update path.
• The material does not show how the mismatched-case key is mapped to the DATA1 column during the update.

Back to June 2026 · Findings