Description
The official React Android debug AARs contain 64-bit binaries whose LOAD alignment is at least 16 KB but whose GNU_RELRO end fails the Android-documented boundary check. This is distinct from APK ZIP alignment.
React Native version
0.87.1; also checked 0.88.0-rc.3. The downstream application currently uses 0.85.2.
Affected platform
Android native artifacts, arm64-v8a and x86_64. An Android 17 compatibility warning prompted this investigation. The reproduction below is static inspection of public artifacts; no minimal-app runtime crash is claimed.
Reproduction
Download the official 0.87.1 debug AAR, extract it, and inspect the JNI files:
curl -fL https://repo1.maven.org/maven2/com/facebook/react/react-android/0.87.1/react-android-0.87.1-debug.aar -o react-android.aar
unzip -q react-android.aar -d react-android
llvm-readelf -Wl react-android/jni/arm64-v8a/libjsi.so | grep -E 'LOAD|GNU_RELRO'
For each GNU_RELRO segment, calculate (VirtAddr + MemSiz) % 0x4000.
Measurements from 0.87.1
| JNI file |
GNU_RELRO VirtAddr |
MemSiz |
End |
Remainder |
| arm64-v8a/libjsi.so |
0xe4af0 |
0x5510 |
0xea000 |
0x2000 |
| x86_64/libjsi.so |
0xe18d0 |
0x5730 |
0xe7000 |
0x3000 |
| arm64-v8a/libreactnative.so |
0x1641eb0 |
0x51150 |
0x1693000 |
0x3000 |
| arm64-v8a/libhermestooling.so |
0x8a860 |
0x37a0 |
0x8e000 |
0x2000 |
| x86_64/libhermestooling.so |
0x83210 |
0x3df0 |
0x87000 |
0x3000 |
The same AAR also contains affected FBJNI and libc++ runtime binaries; those should be distinguished from RN-owned targets. JSI and React Native Prefab copies show the same defect. Do not count 32-bit ABIs or duplicate JNI/Prefab copies as additional affected targets.
The 0.88.0-rc.3 debug AAR also fails: ARM64 libreactnative.so has VirtAddr 0x16a3330 and MemSiz 0x51cd0, ending at 0x16f5000.
Expected / requested change
Publish RN-owned Android binaries with compliant RELRO layouts, adopt corrected FBJNI/Fresco/runtime artifacts, and add validation of the published JNI and Prefab payloads. A compatible passing Hermes artifact was found separately; this is not a request to override Hermes independently of RN.
Reference: Android's RELRO check. Please distinguish this from the earlier general 16 KB support work.
Standalone Project Reproduction (Verified)
https://github.com/pandurirobotii/react-native-android-relro-reproducer
The app is an unchanged snapshot of the official community reproducer template (181acd6681a41578c9067c0e3e3577cb033721fc), pinned to React Native 0.87.1. The README documents the verified project-build reproduction as the primary path:
cd ReproducerApp
yarn install
cd android
./gradlew :app:assembleDebug
cd ../..
python3 -B check_relro.py ReproducerApp/android/app/build/outputs/apk/debug/app-debug.apk
Executed on macOS: dependency installation and debug build succeeded. Inspection of the generated APK checked 22 ARM64/x86_64 libraries: all LOAD alignment checks passed, 17 documented GNU_RELRO end checks failed, and the checker exited 1. The RN-owned libjsi.so, libreactnative.so, and libhermestooling.so measurements above were reproduced in the packaged APK. The total includes bundled and locally built libraries; it is not a count of RN-owned prebuilt targets. Hermes VM passed for both ABIs.
Representative packaged-library finding: ARM64 libjsi.so has vaddr=0xe4af0, memsz=0x5510, end=0xea000, remainder=0x2000.
Android 17 runtime behavior remains untested. This verifies the built APK against the documented static RELRO check, not an observed crash or universal loader rejection. Workflow YAMLs are omitted and Actions is disabled.
Description
The official React Android debug AARs contain 64-bit binaries whose LOAD alignment is at least 16 KB but whose GNU_RELRO end fails the Android-documented boundary check. This is distinct from APK ZIP alignment.
React Native version
0.87.1; also checked 0.88.0-rc.3. The downstream application currently uses 0.85.2.
Affected platform
Android native artifacts, arm64-v8a and x86_64. An Android 17 compatibility warning prompted this investigation. The reproduction below is static inspection of public artifacts; no minimal-app runtime crash is claimed.
Reproduction
Download the official 0.87.1 debug AAR, extract it, and inspect the JNI files:
For each GNU_RELRO segment, calculate
(VirtAddr + MemSiz) % 0x4000.Measurements from 0.87.1
The same AAR also contains affected FBJNI and libc++ runtime binaries; those should be distinguished from RN-owned targets. JSI and React Native Prefab copies show the same defect. Do not count 32-bit ABIs or duplicate JNI/Prefab copies as additional affected targets.
The 0.88.0-rc.3 debug AAR also fails: ARM64 libreactnative.so has VirtAddr 0x16a3330 and MemSiz 0x51cd0, ending at 0x16f5000.
Expected / requested change
Publish RN-owned Android binaries with compliant RELRO layouts, adopt corrected FBJNI/Fresco/runtime artifacts, and add validation of the published JNI and Prefab payloads. A compatible passing Hermes artifact was found separately; this is not a request to override Hermes independently of RN.
Reference: Android's RELRO check. Please distinguish this from the earlier general 16 KB support work.
Standalone Project Reproduction (Verified)
https://github.com/pandurirobotii/react-native-android-relro-reproducer
The app is an unchanged snapshot of the official community reproducer template (181acd6681a41578c9067c0e3e3577cb033721fc), pinned to React Native 0.87.1. The README documents the verified project-build reproduction as the primary path:
Executed on macOS: dependency installation and debug build succeeded. Inspection of the generated APK checked 22 ARM64/x86_64 libraries: all LOAD alignment checks passed, 17 documented GNU_RELRO end checks failed, and the checker exited 1. The RN-owned libjsi.so, libreactnative.so, and libhermestooling.so measurements above were reproduced in the packaged APK. The total includes bundled and locally built libraries; it is not a count of RN-owned prebuilt targets. Hermes VM passed for both ABIs.
Representative packaged-library finding: ARM64 libjsi.so has vaddr=0xe4af0, memsz=0x5510, end=0xea000, remainder=0x2000.
Android 17 runtime behavior remains untested. This verifies the built APK against the documented static RELRO check, not an observed crash or universal loader rejection. Workflow YAMLs are omitted and Actions is disabled.