)]}'
{
  "commit": "f8520e699d1879281623b3b31469c7efa0f860cb",
  "tree": "08b4cd3e887a176d5d957d663f9e2382793661e8",
  "parents": [
    "6654633902f82a2ca2191abbea06dfa274574570"
  ],
  "author": {
    "name": "sadiqsada",
    "email": "sadiqsada@google.com",
    "time": "Tue Jun 30 17:16:49 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 16:34:55 2026 -0700"
  },
  "message": "Fix type confusion in mediatuner service\n\nUnprivileged apps could pass remote binder proxies or custom binder stubs to mediatuner methods such as ITunerDvr::attachFilter, ITunerDemux::getAvSyncHwId, ITunerFilter::setDataSource, ITunerDescrambler::setDemuxSource, and ITunerFrontend::setLnb.\n\nThe mediatuner daemon downcasted these interface pointers to local implementation classes using static_cast without checking if they were remote proxies. This resulted in reading member variables out-of-bounds relative to the proxy allocation, causing type confusion and memory corruption.\n\nThis change adds isRemote() validation checks across all affected AIDL and HIDL service call sites to reject remote proxy binders with Result::INVALID_ARGUMENT.\n\nBug: 514727559\nTest: Tested with custom PoC and valid object flows on Gambit device\nFlag: EXEMPT BUGFIX\n\nTAG\u003dagy\nCONV\u003db1db51a1-e8eb-4c27-9029-027db881f867\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:c2ccf3231695bbb8b144813fe269f9b89624fad3\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:08883052f5dddc486d071a27d3c82091f5393c0b\nMerged-In: Id786837e7dda012109bedf46b95b5e133f898ae3\nChange-Id: Id786837e7dda012109bedf46b95b5e133f898ae3\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "92fa970ba7e2c03de764a393692b14bea981e452",
      "old_mode": 33188,
      "old_path": "services/tuner/TunerDemux.cpp",
      "new_id": "0b801c915fee889787ae5b23f52c0c61a8581f1b",
      "new_mode": 33188,
      "new_path": "services/tuner/TunerDemux.cpp"
    },
    {
      "type": "modify",
      "old_id": "ffe0be95c8f91c0ecaacab486b53ae47c75e33bf",
      "old_mode": 33188,
      "old_path": "services/tuner/TunerDescrambler.cpp",
      "new_id": "eb47e1fcec47ca991206ed58150c8e2867c8c51c",
      "new_mode": 33188,
      "new_path": "services/tuner/TunerDescrambler.cpp"
    },
    {
      "type": "modify",
      "old_id": "fcee9660e4d34761c05982bf1574eee9481c4c81",
      "old_mode": 33188,
      "old_path": "services/tuner/TunerDvr.cpp",
      "new_id": "4ba8e9cf31b270a93c777692b4f4414f92c8dc86",
      "new_mode": 33188,
      "new_path": "services/tuner/TunerDvr.cpp"
    },
    {
      "type": "modify",
      "old_id": "478e7ea526827d1f01e906e2aeaa0d0f5fb2cfea",
      "old_mode": 33188,
      "old_path": "services/tuner/TunerFilter.cpp",
      "new_id": "fda7d10b40e82e5dbe1a8ce0b147adb064056d72",
      "new_mode": 33188,
      "new_path": "services/tuner/TunerFilter.cpp"
    },
    {
      "type": "modify",
      "old_id": "1e93d95b0ccd040f6e9f31340cecb3f6c01637fc",
      "old_mode": 33188,
      "old_path": "services/tuner/TunerFrontend.cpp",
      "new_id": "e041f8e3e8d399c35809eef2a0108652c7b78095",
      "new_mode": 33188,
      "new_path": "services/tuner/TunerFrontend.cpp"
    },
    {
      "type": "modify",
      "old_id": "bbb7782ca6a98092de03bee4aca0b2acc4812e60",
      "old_mode": 33188,
      "old_path": "services/tuner/hidl/TunerHidlDemux.cpp",
      "new_id": "e5f85937dafd281b347b850f6f9d7c57147aa5bc",
      "new_mode": 33188,
      "new_path": "services/tuner/hidl/TunerHidlDemux.cpp"
    },
    {
      "type": "modify",
      "old_id": "51b7edeb128223bc761e6c4fdcb34273ea22817c",
      "old_mode": 33188,
      "old_path": "services/tuner/hidl/TunerHidlDescrambler.cpp",
      "new_id": "de0148b4e54c730333412654e0291f7405b6d540",
      "new_mode": 33188,
      "new_path": "services/tuner/hidl/TunerHidlDescrambler.cpp"
    },
    {
      "type": "modify",
      "old_id": "285e32b24b389055c5d0ea1dc0ec631a045c5025",
      "old_mode": 33188,
      "old_path": "services/tuner/hidl/TunerHidlDvr.cpp",
      "new_id": "7009a539a1842d2b46bf9f070f21d2f3ea489f41",
      "new_mode": 33188,
      "new_path": "services/tuner/hidl/TunerHidlDvr.cpp"
    },
    {
      "type": "modify",
      "old_id": "617622d529e853f07a9b88553574ca8e46e0741c",
      "old_mode": 33188,
      "old_path": "services/tuner/hidl/TunerHidlFilter.cpp",
      "new_id": "e9cd71ce4a158b73ea5a2bc36ebb5c7023e0705e",
      "new_mode": 33188,
      "new_path": "services/tuner/hidl/TunerHidlFilter.cpp"
    },
    {
      "type": "modify",
      "old_id": "7ffb2a40c1e4b9d24d1148f9a0f449dce575b347",
      "old_mode": 33188,
      "old_path": "services/tuner/hidl/TunerHidlFrontend.cpp",
      "new_id": "7d591d0fab2b8b16e8963e61b50fa019b450e0d3",
      "new_mode": 33188,
      "new_path": "services/tuner/hidl/TunerHidlFrontend.cpp"
    }
  ]
}