Re: Integer overflows in memchr

[Po Lu]

Paul Eggert <eggert@cs.ucla.edu> writes:

> On 6/27/24 01:55, Po Lu wrote:
>> Google continue to support SDKs from 19 onwards in the standard support
>> library:
>>    
>> https://android-developers.googleblog.com/2023/10/androidx-minsdkversion-19.html
>> which is the real threshold at which official support ends.
>
> Thanks, I don't know all the ins and outs of Google support
> levels. Though it seems that starting in April, that library
> environment is now supporting only API levels 21 and up
> <https://developer.android.com/jetpack/androidx/versions>, which
> corresponds to Android 5.0 and later.
>
> So, as I understand it, even though Google supports only Android 12
> (API 31, 2021) and later, in the sense that it no longer issues
> security patches etc. for older Android releases, Google also supplies
> extensions to Android (called Jetpack) that are separate and that will
> run on Android releases back to Android 5.0 (API 21, 2014).

Yes, correct.  I wasn't aware that this requirement was raised.

> Given that the strnlen bug was fixed in Android 5.1 (API 22, 2015),
> the only remaining problematic Android release is Android 5.0, where
> the Gnulib strnlen module doesn't detect the Android bug and therefore
> doesn't work around it. Presumably Google will update Jetpack's
> minimum supported API soon, at which point this issue will become
> academic. The abovementioned URL says that about 99.2% of Android
> users are running 5.1 or later and so shouldn't see the problem. Since
> only about 0.3% of Android users are running 5.0 perhaps it's not
> worth worrying about this for Gnulib.

Emacs would prefer to support 100.00% of Android users, though it
currently settles for the earliest version which is technically feasible
to support, i.e. Android 2.2.  I won't elaborate on the fairly obvious
rationale (to anyone who has read Google's ridiculously miserly product
lifecycles), which is not material to this list, but there is still a
significant number of users of these officially extinct releases, among
whom Emacs is probably more popular than average.  For instance, there
are brand new devices available equipped with processors designed early
in the 2010s with no support for newer versions of Android.  This model:

  https://www.aliexpress.com/item/1005005664241412.html

sold with Android 4.2 and upgradable to 4.4, but no further, has been
the source of plenty of Emacs bug reports concerning those two systems.