)]}'
{
  "commit": "2d627fe89937d56a47db5b6c5e1adc38edbb6136",
  "tree": "8967aabaab1e04dee23d6607b57071c734fe998a",
  "parents": [
    "f19372384733df7c8acca90d5a31e8dd813757f2"
  ],
  "author": {
    "name": "Venkatarama Avadhani",
    "email": "venkataramaa@google.com",
    "time": "Wed Apr 15 11:45:51 2026 +0530"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 17:46:41 2026 -0700"
  },
  "message": "[media] Fix heap-buffer-overflow in AudioAttributes unmarshalling\n\nThis CL fixes a heap-buffer-overflow in MediaPlayerService\u0027s AudioAttributes\nunmarshalling logic. The source length was in bytes and the\nutf16_to_utf8 uses char16_t pointer arithmetic on it that would lead to\nan OOB read. Corrected the source length parameter to give length as\nnumber of char16_t.\nThe destination length has to be 1 less than the actual size of the\ndestination since utf16_to_utf8 adds a NULL terminator. Correct this\nbehaviour to limit the destination length to allocated length - 1.\n\nBug: 482172329\nBug: 396471524\n\nTest: fuzzer with the testcases\nTest: atest CtsMediaAudioTestCases CtsMediaPlayerTestCases libutils_tests\n\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:50d6c98e00c2c5620ea50e26c9c44e70a0c5ce8a\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:f59d5d597fdf9daf8b12e54c7a7775035f3531ca\nMerged-In: I9f607d57281c76d8e1c1a14112dffdf22acb8080\nChange-Id: I9f607d57281c76d8e1c1a14112dffdf22acb8080\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "10a1da7ce618db038952e1446ee9e5f30413e051",
      "old_mode": 33188,
      "old_path": "media/libmediaplayerservice/MediaPlayerService.cpp",
      "new_id": "95582c7834d4c84853c3cd9a8514c6d5b54942c7",
      "new_mode": 33188,
      "new_path": "media/libmediaplayerservice/MediaPlayerService.cpp"
    }
  ]
}