)]}'
{
  "commit": "7a05282afe4230ba4c6d2a162d2ea2237d778c3c",
  "tree": "c7ea45395595d474941a3696404c1553aad04970",
  "parents": [
    "db3b431dd8aa0ba006499d20fe3cd607c40ac9ad"
  ],
  "author": {
    "name": "Venkatarama Avadhani",
    "email": "venkataramaa@google.com",
    "time": "Wed Apr 15 11:45:51 2026 +0530"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 15:38:48 2026 -0700"
  },
  "message": "[media] Fix heap-buffer-overflow in AudioAttributes unmarshalling\n\nThis CL fixes a heap-buffer-overflow in MediaPlayerService\u0027s AudioAttributes\nunmarshalling logic. The source length was in bytes and the\nutf16_to_utf8 uses char16_t pointer arithmetic on it that would lead to\nan OOB read. Corrected the source length parameter to give length as\nnumber of char16_t.\nThe destination length has to be 1 less than the actual size of the\ndestination since utf16_to_utf8 adds a NULL terminator. Correct this\nbehaviour to limit the destination length to allocated length - 1.\n\nBug: 482172329\nBug: 396471524\n\nTest: fuzzer with the testcases\nTest: atest CtsMediaAudioTestCases CtsMediaPlayerTestCases libutils_tests\n\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:50d6c98e00c2c5620ea50e26c9c44e70a0c5ce8a\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:4900a9a6131d54669801e8a547822e63657c3e02\nMerged-In: I9f607d57281c76d8e1c1a14112dffdf22acb8080\nChange-Id: I9f607d57281c76d8e1c1a14112dffdf22acb8080\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9e9e9d842ae781a28b5183ee4a51391b3285c110",
      "old_mode": 33188,
      "old_path": "media/libmediaplayerservice/MediaPlayerService.cpp",
      "new_id": "c84c6cda1a9a83b2f8207354aefb560dbb3e94ed",
      "new_mode": 33188,
      "new_path": "media/libmediaplayerservice/MediaPlayerService.cpp"
    }
  ]
}