Researcher finds n-days in outdated AOSP external/ libraries

Independent researcher Vladimir Garenitsa (MalwareDante) described a fuzzing platform on a 2-core VPS targeting vendored forks of parsing libraries in AOSP external/. external/libexif ships version 0.6.21 from June 2015, while external/flac is 1.4.3 versus upstream 1.5.0 with overflow checks. Of 778 triaged artifacts and 97 signatures, all are UB-class with no memory corruption so far; one bug is libde265#546.

• AOSP external/libexif is 0.6.21 from June 2015, unchanged for 11 years
• external/flac is 1.4.3 versus upstream 1.5.0 with parser-hardening checks
• 778 artifacts and 97 signatures: all UB-class, no memory corruption yet
• One unfixed bug reported: libde265#546 in release 1.1.2 and git master