The Bug Is on Every Android 17 Phone, but Not in the Source Code Anyone Can See

说明与用途

在 Android 17 中，wcscspn() 和 wcspbrk() 对 U+0100 以上字符返回错误结果，导致应用程序失败。通过最小重现、代码扫描和二进制反汇编识别错误，随后在源代码中修复并更新测试。

问题

Android 17’s libc functions wcscspn() and wcspbrk() returned incorrect results for inputs containing characters above U+0100, causing failures in applications such as Visual Pinball that rely on these functions.

结果

The bug was traced to an incorrect branch in an optimized lookup table path for wcscspn() and wcspbrk(), fixed in the libc source, and the test suite was corrected to prevent future regressions.

工作流

• 1. Isolate the issue with a minimal C reproducer that demonstrates the incorrect return value.
• 2. Sweep the Unicode code point space to quantify affected inputs (1,111,808).
• 3. Analyze the input space to identify the boundary conditions (two or more ASCII characters in the set).
• 4. Disassemble the shipped libc.so from a Pixel 7/8a to reconstruct the optimized loop logic.
• 5. File a detailed issue on the Android NDK repository with build fingerprints and reproducer.
• 6. Verify the fix and update the test suite to assert correct behavior.

证据

On Android 17 builds from September 2026, two standard C functions stop working correctly: wcscspn() and wcspbrk().

来源

The existing test itself asserted the incorrect behavior. It expected wcscspn(L"he￾lo", L"lo") to return 2, when the correct answer is 3.

来源

The reporter swept every code point from U+0001 to U+10FFFF. The function returns a wrong answer for 1,111,808 of them.

来源