)]}'
{
  "commit": "b8080da68249309202654e7fdfb8cdb1c54df509",
  "tree": "a0230df1492c6fbf4bf0e6609186cfec7eefafc3",
  "parents": [
    "d8a3aff45267ac5df649780d9a7b7b715c021bfd"
  ],
  "author": {
    "name": "Venkatarama Avadhani",
    "email": "venkataramaa@google.com",
    "time": "Wed Apr 15 11:45:51 2026 +0530"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 18:59:50 2026 -0700"
  },
  "message": "[media] Fix heap-buffer-overflow in AudioAttributes unmarshalling\n\nThis CL fixes a heap-buffer-overflow in MediaPlayerService\u0027s AudioAttributes\nunmarshalling logic. The source length was in bytes and the\nutf16_to_utf8 uses char16_t pointer arithmetic on it that would lead to\nan OOB read. Corrected the source length parameter to give length as\nnumber of char16_t.\nThe destination length has to be 1 less than the actual size of the\ndestination since utf16_to_utf8 adds a NULL terminator. Correct this\nbehaviour to limit the destination length to allocated length - 1.\n\nBug: 482172329\nBug: 396471524\n\nTest: fuzzer with the testcases\nTest: atest CtsMediaAudioTestCases CtsMediaPlayerTestCases libutils_tests\n\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:50d6c98e00c2c5620ea50e26c9c44e70a0c5ce8a\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:97e1a7fb070545e9b4d39ddcb51a69b8a1a7744b\nMerged-In: I9f607d57281c76d8e1c1a14112dffdf22acb8080\nChange-Id: I9f607d57281c76d8e1c1a14112dffdf22acb8080\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a5c8545e407dc93bcff192b64d4be060182d1b15",
      "old_mode": 33188,
      "old_path": "media/libmediaplayerservice/MediaPlayerService.cpp",
      "new_id": "a5f40de5e515eee58ff096cdd1263a4fbfaea542",
      "new_mode": 33188,
      "new_path": "media/libmediaplayerservice/MediaPlayerService.cpp"
    }
  ]
}