CVE-2026-49926 AI-generated analysis
platform/external/libjxl, Android.bp build configuration for the `libjxl` cc_library (JPEG XL library)
Removes `integer_overflow: true` from the sanitize block of the `libjxl` cc_library in external/libjxl Android.bp, so that unsigned integer wrap-around that upstream libjxl uses on purpose no longer triggers UBSan aborts.
Root cause
The Android build of libjxl (cc_library "libjxl" in Android.bp) enabled Soong's `integer_overflow` sanitizer on top of `all_undefined`. Upstream libjxl uses unsigned wrap-around on purpose in several places (the commit names ClampedGradient and backward loops). Unsigned overflow is defined behavior in C++, but with this sanitizer enabled those wrap-arounds triggered UBSan aborts on Android, which the bulletin rates as a Critical denial of service.
How the fix works
- Android.bp :: cc_library { name: "libjxl" }: the single line `integer_overflow: true,` is deleted from the `sanitize` block, and `all_undefined: true` is kept. According to the commit message, signed-overflow and other UB sanitizers stay enabled, and only the unsigned-overflow instrumentation that caused the aborts is removed.
- No C++ source is changed. The fix is only a build-configuration change, chosen (per the commit) to avoid maintaining extensive local patches against upstream libjxl.
- The commit names `atest CtsGraphicsTestCases:android.graphics.cts.ImageDecoderTest#testInterestingDngs` as its test.
Completeness
- The fix covers every source compiled into the `libjxl` module (libjxl_dec_sources, libjxl_dec_box_sources, libjxl_dec_jpeg_sources, libjxl_enc_sources, libjxl_threads_sources, lib/jxl/cms/jxl_cms.cc), because the sanitizer setting applies to the whole module.
- No libjxl code is changed: the unsigned wrap-around sites stay as upstream wrote them, and the sanitizer simply no longer traps on them. If any such site were a real logic error rather than intentional, it would now go unnoticed instead of aborting. The material shows no such case.
- `all_undefined: true` remains, so per the commit, signed-overflow and other UB checks are still enabled in this module. A genuine signed overflow in libjxl would therefore still abort. The material shows none.
- Only the `libjxl` cc_library in Android.bp is shown. The material does not show whether any other module enables integer_overflow.
Behavior changes
- libjxl no longer aborts its host process when unsigned arithmetic wraps. Those operations now complete with normal modular arithmetic.
- Unsigned-overflow instrumentation is removed from libjxl, so future unsigned wrap-around in this library will no longer be reported by UBSan on Android builds.
- The diff shows no API change.
Per major
- Android 14: not affected per the bulletin; external/libjxl is not present in android-security-14.0.0_r29.
- Android 15: not affected per the bulletin; external/libjxl is not present in android-security-15.0.0_r17.
- Android 16: not affected per the bulletin; external/libjxl is not present in android-security-16.0.0_r8.
- Android 17: same fix: commit 069d75c482c7 in android-security-17.0.0_r1, a cherry-pick of commit 2b1649223ad2 (Change-Id I5bac14ad6973b3bc7dbbf865c2159f9f233f728c). At that tag the sanitize block contains only `all_undefined: true`, which matches the one-line deletion.
Unknowns
- Which processes link libjxl on Android 17, and how outside data reaches them. The index results (AImageDecoder, stb_image, libjpeg) are not direct libjxl callers.
- Exact libjxl source locations and inputs that trigger the unsigned wrap, beyond the commit's mention of ClampedGradient and backward loops.
- How the DNG test named in the commit relates to libjxl.
- The bulletin's affected-versions list includes 16-qpr2, but the per-major facts treat Android 16 as not affected and the project is absent from the Android 16 security tag. The state of 16-qpr2 is unclear.
- Whether a global sanitizer setting could re-enable integer_overflow for this module. The fix does not add an explicit `integer_overflow: false`.
- Whether the abort happened in every build configuration.