)]}'
{
  "commit": "6ff99fe0d5b1dabc1e06b65c73c371337278d2a8",
  "tree": "ccf837332c686448acb7a88310e3234d592f95df",
  "parents": [
    "f3bd2850bafd6014b1c287cc9b00fd5f7a0e71e4"
  ],
  "author": {
    "name": "Venkatarama Avadhani",
    "email": "venkataramaa@google.com",
    "time": "Wed Apr 15 11:45:51 2026 +0530"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 18:19:25 2026 -0700"
  },
  "message": "[media] Fix heap-buffer-overflow in AudioAttributes unmarshalling\n\nThis CL fixes a heap-buffer-overflow in MediaPlayerService\u0027s AudioAttributes\nunmarshalling logic. The source length was in bytes and the\nutf16_to_utf8 uses char16_t pointer arithmetic on it that would lead to\nan OOB read. Corrected the source length parameter to give length as\nnumber of char16_t.\nThe destination length has to be 1 less than the actual size of the\ndestination since utf16_to_utf8 adds a NULL terminator. Correct this\nbehaviour to limit the destination length to allocated length - 1.\n\nBug: 482172329\nBug: 396471524\n\nTest: fuzzer with the testcases\nTest: atest CtsMediaAudioTestCases CtsMediaPlayerTestCases libutils_tests\n\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:50d6c98e00c2c5620ea50e26c9c44e70a0c5ce8a\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:8926da1d9c9db3031bc8a7075927c3ebec3292cd\nMerged-In: I9f607d57281c76d8e1c1a14112dffdf22acb8080\nChange-Id: I9f607d57281c76d8e1c1a14112dffdf22acb8080\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f843ada82eb0bb3749a140826ecb4573744b4d6f",
      "old_mode": 33188,
      "old_path": "media/libmediaplayerservice/MediaPlayerService.cpp",
      "new_id": "41a86aea98c29a63d8fe4fa87df79b7f911d539d",
      "new_mode": 33188,
      "new_path": "media/libmediaplayerservice/MediaPlayerService.cpp"
    }
  ]
}