The Bug Is on Every Android 17 Phone, but Not in the Source Code Anyone Can See

Описание и применение

В Android 17 функции wcscspn() и wcspbrk() неверно обрабатывали символы выше U+0100, что привело к сбоям в приложениях. Баг выявлен через минимальный репродусер, анализ кода и дизассемблирование бинарника, после чего исправлен в исходниках и обновлены тесты.

Задача

Android 17’s libc functions wcscspn() and wcspbrk() returned incorrect results for inputs containing characters above U+0100, causing failures in applications such as Visual Pinball that rely on these functions.

Результат

The bug was traced to an incorrect branch in an optimized lookup table path for wcscspn() and wcspbrk(), fixed in the libc source, and the test suite was corrected to prevent future regressions.

Рабочий процесс

• 1. Isolate the issue with a minimal C reproducer that demonstrates the incorrect return value.
• 2. Sweep the Unicode code point space to quantify affected inputs (1,111,808).
• 3. Analyze the input space to identify the boundary conditions (two or more ASCII characters in the set).
• 4. Disassemble the shipped libc.so from a Pixel 7/8a to reconstruct the optimized loop logic.
• 5. File a detailed issue on the Android NDK repository with build fingerprints and reproducer.
• 6. Verify the fix and update the test suite to assert correct behavior.

Доказательства

On Android 17 builds from September 2026, two standard C functions stop working correctly: wcscspn() and wcspbrk().

Источник

The existing test itself asserted the incorrect behavior. It expected wcscspn(L"he￾lo", L"lo") to return 2, when the correct answer is 3.

Источник

The reporter swept every code point from U+0001 to U+10FFFF. The function returns a wrong answer for 1,111,808 of them.

Источник