AOSP源代码发布延迟迫使开发者反汇编库文件报告漏洞

Android 17版本（CP3A.260905.009，2026年9月构建）中的wcscspn()和wcspbrk()函数存在严重漏洞1。当拒绝集合包含两个或更多小于0x0100的字符时，这两个函数会错误地将所有大于等于0x100的字符（包括emoji和CJK字符）识别为匹配项并停止扫描1。受影响的代码点范围从U+0100到U+10FFFF，涉及超过111万个字符1。

由于AOSP源代码发布（android-latest-release）延迟超过一个月，开发者无法直接查看源代码，被迫通过反汇编NDK r29的二进制库来分析和报告这一漏洞1。这一问题在实际应用中已造成影响：Visual Pinball的libwinevbs库在加载包含emoji注释的VBScript时停止运行，FileSystem.MoveFolder函数在处理含有非ASCII字符的路径时出现错误1。

A critical bug in Android 17's wide-character string functions has exposed the consequences of delayed source code releases from the Android Open Source Project. Developers discovered severe defects in the wcscspn() and wcspbrk() functions within build CP3A.260905.009 (September 2026), which incorrectly halt scanning when reject sets contain two or more characters below 0x0100, treating all characters from 0x100 onward—including emoji and CJK characters—as matches 1. The bug affects over 1.1 million Unicode code points ranging from U+0100 to U+10FFFF 1. Real-world consequences have already emerged, with applications like Visual Pinball experiencing failures, such as the libwinevbs library ceasing to load VBScript files containing emoji comments and FileSystem.MoveFolder incorrectly handling paths with non-ASCII characters 1.

Unable to access the source code directly, developers were forced to disassemble binary libraries to analyze and report the issue, a workaround made necessary because AOSP's official source releases lag more than a month behind binary builds 1. The bug exists in NDK r29 and the Android 17 bionic library, yet the delayed availability of source code on the android-latest-release branch prevented timely investigation through conventional means 1.