In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"types": [
"DoS"
],
"spl": "2021-01-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"vanir_signatures": [
{
"target": {
"function": "isWordBreakAfter",
"file": "libs/minikin/LayoutUtils.cpp"
},
"signature_version": "v1",
"digest": {
"function_hash": "77199152967563880133127078149246770736",
"length": 155.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"id": "ASB-A-170968514-36cd12b7"
},
{
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
]
},
"id": "ASB-A-170968514-c7f65a2d",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"signature_version": "v1"
}
]
}{
"types": [
"DoS"
],
"spl": "2021-01-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"vanir_signatures": [
{
"target": {
"function": "isWordBreakAfter",
"file": "libs/minikin/LayoutUtils.cpp"
},
"digest": {
"function_hash": "77199152967563880133127078149246770736",
"length": 155.0
},
"id": "ASB-A-170968514-41a8bdf1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
},
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"id": "ASB-A-170968514-657ac47e",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"signature_version": "v1"
}
]
}{
"types": [
"DoS"
],
"spl": "2021-01-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"vanir_signatures": [
{
"id": "ASB-A-170968514-97529edb",
"digest": {
"function_hash": "77199152967563880133127078149246770736",
"length": 155.0
},
"signature_version": "v1",
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"target": {
"function": "isWordBreakAfter",
"file": "libs/minikin/LayoutUtils.cpp"
}
},
{
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
},
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"id": "ASB-A-170968514-9a2032cc",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"signature_version": "v1"
}
]
}{
"types": [
"DoS"
],
"spl": "2021-01-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"vanir_signatures": [
{
"id": "ASB-A-170968514-41fab337",
"digest": {
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
}
},
{
"target": {
"function": "isWordBreakAfter",
"file": "libs/minikin/LayoutUtils.cpp"
},
"signature_version": "v1",
"digest": {
"function_hash": "77199152967563880133127078149246770736",
"length": 155.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"id": "ASB-A-170968514-ddc43c0b"
}
]
}{
"types": [
"DoS"
],
"spl": "2021-01-01",
"fixes": [
"https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349"
],
"severity": "Critical",
"vanir_signatures": [
{
"target": {
"function": "isWordBreakAfter",
"file": "libs/minikin/LayoutUtils.cpp"
},
"signature_version": "v1",
"digest": {
"function_hash": "77199152967563880133127078149246770736",
"length": 155.0
},
"signature_type": "Function",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"id": "ASB-A-170968514-0c9c19e2"
},
{
"target": {
"file": "libs/minikin/LayoutUtils.cpp"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284235645884377277334911639850463629827",
"289554550184100760855821583177728481305",
"119258988697698457769296765622298402469",
"147242531554428115735251375970441656677"
]
},
"signature_type": "Line",
"source": "https://android.googlesource.com/platform/frameworks/minikin/+/ffb33bcf2520208166cb29f47c60add9c0e37349",
"deprecated": false,
"id": "ASB-A-170968514-f8c98187"
}
]
}