)]}'
{
  "commit": "f3bd2850bafd6014b1c287cc9b00fd5f7a0e71e4",
  "tree": "89a27e1aa96d08cbe30284c7267f323710842954",
  "parents": [
    "d1137ad4b24b686d9b00fd1b7be1b520f7b6ee2b"
  ],
  "author": {
    "name": "Venkatarama Avadhani",
    "email": "venkataramaa@google.com",
    "time": "Wed Apr 08 12:57:36 2026 +0530"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Thu Jul 09 18:19:16 2026 -0700"
  },
  "message": "[media] Fix heap out-of-bounds write in MatroskaSource::read\n\nThe root cause was incorrect pointer arithmetic where a byte-level\noffset (frame-\u003erange_offset()) was added directly to a uint16_t*\npointer. This caused the effective byte offset to be doubled (scaled by\nthe size of uint16_t), leading the subsequent ntohs() operation to write\npast the end of the allocated buffer.\n\nThis change corrects the pointer arithmetic by casting the data pointer\nto uint8_t* before applying the range offset, ensuring the pointer\nadvances by the correct number of bytes.\n\nBug: 485020640\nTest: Reproduced crash with PoC, verified patch fixes the issue.\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:11fab348d2f19f961aa5f77ebd982302b1c6fb97\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:a4955af6dee107f449137db905e6817c10a76610\nMerged-In: I723ea6520c30d3dcafb03bf15fabdd41ab58715f\nChange-Id: I723ea6520c30d3dcafb03bf15fabdd41ab58715f\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "10ae07adf32b78f9adc8748f9fcc67ef6e4d31e9",
      "old_mode": 33188,
      "old_path": "media/module/extractors/mkv/MatroskaExtractor.cpp",
      "new_id": "0e99d4b3279b4521e10a4d48f90895bca9b8808d",
      "new_mode": 33188,
      "new_path": "media/module/extractors/mkv/MatroskaExtractor.cpp"
    }
  ]
}