)]}'
{
  "commit": "ccc63274119beea61d9dd81cfb60026b30c1d5a5",
  "tree": "cc477c26556882fc984bb2caa99809d6381ee93a",
  "parents": [
    "122c16b605e9fba506d1389de9f1a6dfa0647d00"
  ],
  "author": {
    "name": "Duy Truong",
    "email": "duytruong@google.com",
    "time": "Sat May 23 04:16:06 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 18:00:20 2026 -0700"
  },
  "message": "Fix MediaBuffer size-inflation off-by-32 bug\n\nThe MediaBuffer constructor taking an IMemory was advancing the data\npointer by sizeof(SharedControl) but was not reducing the size field,\nleading to a 32-byte inflation in the reported size. This could cause\nan out-of-bounds write if the buffer is the last carve-out in a page-exact\nashmem mapping.\n\nThis CL fixes the issue by correctly reducing the size field by\nsizeof(SharedControl) when advancing the data pointer.\n\nThis was autogenerated by MendIt (go/androidmendit).\n\nBug: 503541238\nTest: m libstagefright_foundation libstagefright\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:821190f16645f2a02f497b9e5eb8046a7ac2f9e8\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:4adcf41dddc3636fc96bb22656a617420ad950e6\nMerged-In: Ie936d94d4b4d69b3fe582cdf315c12c7cb673011\nChange-Id: Ie936d94d4b4d69b3fe582cdf315c12c7cb673011\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f070aace11203d14258f47c51aefda52f8a9641a",
      "old_mode": 33188,
      "old_path": "media/libstagefright/include/media/stagefright/MediaBuffer.h",
      "new_id": "78dc7ff1449ccd72e9d532a8fd00810352ee7a35",
      "new_mode": 33188,
      "new_path": "media/libstagefright/include/media/stagefright/MediaBuffer.h"
    }
  ]
}