In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"spl": "2021-01-01",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-36cd12b7",
"digest": {
"length": 155.0,
"function_hash": "77199152967563880133127078149246770736"
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Function",
"target": {
"file": "libs/minikin/LayoutUtils.cpp",
"function": "isWordBreakAfter"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-c7f65a2d",
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Line",
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
}
}
],
"types": [
"DoS"
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"spl": "2021-01-01",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-41a8bdf1",
"digest": {
"length": 155.0,
"function_hash": "77199152967563880133127078149246770736"
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Function",
"target": {
"file": "libs/minikin/LayoutUtils.cpp",
"function": "isWordBreakAfter"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-657ac47e",
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Line",
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
}
}
],
"types": [
"DoS"
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"spl": "2021-01-01",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-97529edb",
"digest": {
"length": 155.0,
"function_hash": "77199152967563880133127078149246770736"
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Function",
"target": {
"file": "libs/minikin/LayoutUtils.cpp",
"function": "isWordBreakAfter"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-9a2032cc",
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Line",
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
}
}
],
"types": [
"DoS"
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"spl": "2021-01-01",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-41fab337",
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Line",
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-ddc43c0b",
"digest": {
"length": 155.0,
"function_hash": "77199152967563880133127078149246770736"
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Function",
"target": {
"file": "libs/minikin/LayoutUtils.cpp",
"function": "isWordBreakAfter"
}
}
],
"types": [
"DoS"
]
}{
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"spl": "2021-01-01",
"vanir_signatures": [
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-0c9c19e2",
"digest": {
"length": 155.0,
"function_hash": "77199152967563880133127078149246770736"
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Function",
"target": {
"file": "libs/minikin/LayoutUtils.cpp",
"function": "isWordBreakAfter"
}
},
{
"deprecated": false,
"signature_version": "v1",
"id": "ASB-A-170968514-f8c98187",
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"signature_type": "Line",
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
}
}
],
"types": [
"DoS"
]
}