)]}'
{
  "commit": "237289dd22e131dfb3c1f2438c793968f7f7ea11",
  "tree": "451168cd8d71e7be5fe87d9821e7bac91c08fde1",
  "parents": [
    "9c53448d56c93c2b35aec9ab014c6f6462d44bb4"
  ],
  "author": {
    "name": "Duy Truong",
    "email": "duytruong@google.com",
    "time": "Sat May 23 04:16:06 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 17:41:14 2026 -0700"
  },
  "message": "Fix MediaBuffer size-inflation off-by-32 bug\n\nThe MediaBuffer constructor taking an IMemory was advancing the data\npointer by sizeof(SharedControl) but was not reducing the size field,\nleading to a 32-byte inflation in the reported size. This could cause\nan out-of-bounds write if the buffer is the last carve-out in a page-exact\nashmem mapping.\n\nThis CL fixes the issue by correctly reducing the size field by\nsizeof(SharedControl) when advancing the data pointer.\n\nThis was autogenerated by MendIt (go/androidmendit).\n\nBug: 503541238\nTest: m libstagefright_foundation libstagefright\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:821190f16645f2a02f497b9e5eb8046a7ac2f9e8\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:760e2214a4ac391d0e4f19575fa67cbaf2675f47\nMerged-In: Ie936d94d4b4d69b3fe582cdf315c12c7cb673011\nChange-Id: Ie936d94d4b4d69b3fe582cdf315c12c7cb673011\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f070aace11203d14258f47c51aefda52f8a9641a",
      "old_mode": 33188,
      "old_path": "media/libstagefright/include/media/stagefright/MediaBuffer.h",
      "new_id": "78dc7ff1449ccd72e9d532a8fd00810352ee7a35",
      "new_mode": 33188,
      "new_path": "media/libstagefright/include/media/stagefright/MediaBuffer.h"
    }
  ]
}