Android 17's libc breaks wide-string scanning for any character above U+00FF
AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs
On Android 17 builds from September 2026, wcscspn() and wcspbrk() incorrectly treat every wchar_t >= 0x100 as a match when the reject set contains two or more characters all below 0x100. The bug, introduced after the June release, affects any code scanning wide strings for ASCII delimiters, such as newline or wildcard characters, and breaks as soon as text contains emoji, CJK, Cyrillic, Greek, or Latin Extended characters. Disassembly of the shipped libc.so reveals a 256-byte lookup table that stops scanning prematurely for high code points.
A character >= 0x100 cannot be in a set whose members are all < 0x100, so for wcscspn the scan must continue past it. The code stops instead.
- kodebach
I can't prove it, but I still think this is (partly) due to a recent EU regulation majorly backfiring.
I can't remember which one it was, but one of the recent regulations mandates that devices get updates for a certain period. Within that period a manufacturer must provide each update for all their devices in a short timeframe. The intention was to prevent flagships getting updates immediately and lower end devices having to wait months.
However, due to some (also well intentioned) wording about open source, the release of the source code is counted as the first release of an update and starts the timer.
I'm pretty sure Google is delaying public AOSP updates to give their partners (mainly Samsung I suppose) more time to finish building their updates on top of AOSP.
- userbinator
One character: a plain compare loop. Correct.
Not surprisingly, I get slight hints of Claudism in the text.
AI "opening" the source of software is one of the best things I've seen going for it so far.
- reddalo
The new Google motto seems to be "be as evil as you can".
We need an Android alternative, something that respects users' freedom.
- evan_a_a
Bit of a hyperbolistic title. The core of the bug report doesn't require disassembly of the library. The bug author just went the extra step to do a root cause investigation, which of course requires light reversing work.
- dethos
We need a third option. Be it SalfishOS, Ubuntu Touch, Nura, or whatever picks up with a sizable community. We just need to start developing and investing in that one. It won't be perfect, but it will offer an alternative and control to the users.
- Retr0id
It'd be mildly amusing if this led to someone doing an AI-powered decompilation of AOSP.
- senfiaj
AI is starting to successfully decompile binaries, unless the binary isn't purposefully obfuscated, I guess it's almost "open source".
- duttonw
Google not releasing won’t help now in the ai age….