)]}'
{
  "commit": "01bff648b538e752ebc914bbeca250373f4922c5",
  "tree": "21e642b67575e03c291774d96061b5ea7f6d9cd0",
  "parents": [
    "a0bd9f4b3d53ef2942c605f733d384f9abc2664c"
  ],
  "author": {
    "name": "Jeremy Meyer",
    "email": "jakmcbane@google.com",
    "time": "Thu May 21 15:46:02 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 18:01:34 2026 -0700"
  },
  "message": "ResStringPool: Validate styleCount and offsets\n\nResStringPool::setTo fails to validate that the style-index array fits\nwithin the data chunk when stringCount is zero, as it was skipping\nvalidation of stringsStart. An attacker could craft a ResStringPool\nwith a large styleCount and a huge stringsStart, bypassing current\nchecks and leading to an OOB heap read in ResStringPool::styleAt.\n\nThis change:\n1. Validates stringsStart and stylesStart against the total size early.\n2. Improves the styleCount bounds check to ensure the style offset array\n   fits within the chunk and doesn\u0027t overlap with string data.\n\nBug: 499091487\nTest: atest libandroidfw_tests --host\nFlag: EXEMPT BUGFIX\n\n(cherry picked from commit 968cb0736ca65b22a3c7230820912adffa452b1e)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:f4a6d1160920868b9ba354f84023e39371a8c2ba\nMerged-In: I3e1e4579fbda8ee89c5fea3945d523c6e5b72dc9\nChange-Id: I3e1e4579fbda8ee89c5fea3945d523c6e5b72dc9\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "df864d362265be486283dbf3e17c944f2ec2f3c7",
      "old_mode": 33188,
      "old_path": "libs/androidfw/ResourceTypes.cpp",
      "new_id": "fbd0ede130dd5995403c701ac7b6cd43ae6dc619",
      "new_mode": 33188,
      "new_path": "libs/androidfw/ResourceTypes.cpp"
    },
    {
      "type": "modify",
      "old_id": "8ef1d0be0a3f2cddd686825e27e406fdd06eb77f",
      "old_mode": 33188,
      "old_path": "libs/androidfw/tests/ResourceTypes_test.cpp",
      "new_id": "0fe6b225e4f32ca07a8502aa8e57bcf5773b1041",
      "new_mode": 33188,
      "new_path": "libs/androidfw/tests/ResourceTypes_test.cpp"
    }
  ]
}