)]}'
{
  "commit": "057ff07691a6c6d8deea350c44ef10a012cb9204",
  "tree": "c814cdb4d3ca9fa877726952234d312bbf6bbc4f",
  "parents": [
    "129f80c33f1f0e414f23523c1a44d410e439d60f"
  ],
  "author": {
    "name": "Iustin Ventaniuc",
    "email": "iustiniv@google.com",
    "time": "Sun Jun 21 01:22:22 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 16:36:16 2026 -0700"
  },
  "message": "Fix boot-loop vulnerability in setPermissionGrantState\n\nA malicious BYOD work-profile DPC could persistently boot-loop the device by passing an out-of-range `grantState` to `setPermissionGrantState()`. This unvalidated value was saved to disk and threw an uncaught `IllegalArgumentException` during subsequent `system_server` boots, requiring a factory reset.\n\nThis commit fixes the issue by:\n1. Adding a `Preconditions.checkArgument` in `DevicePolicyManagerService` to validate the `grantState` when the coexistence flag is enabled, preventing invalid states from being stored.\n2. Wrapping policy re-application calls in `DevicePolicyEngine` with try-catch blocks to ensure that any invalid saved policy state logs a non-fatal error instead of crashing the `system_server` during boot.\n\nTest: Added and ran testSetPermissionGrantState_coexistence_invalidState_throwsException in DevicePolicyManagerTest\n\nBug: 515158597\nFlag: EXEMPT BUGFIX\nThis was autogenerated by MendIt (go/androidmendit)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:f5cf9571ac81791f9245fd16dfcf42ecd51c793d\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:c7f2a0341d5058a97a412cd2ca99dbd431752143\nMerged-In: I090604a48f409e5109327217f642730258fb720f\nChange-Id: I090604a48f409e5109327217f642730258fb720f\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9f65a33185b5e6160a84d9d2416f2ca45c9f2983",
      "old_mode": 33188,
      "old_path": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java",
      "new_id": "a21cec42cc9165d73757fc3cc1ff3e2babbb6431",
      "new_mode": 33188,
      "new_path": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyEngine.java"
    },
    {
      "type": "modify",
      "old_id": "8929ce01787bfa2470962d85bdb68b6358dfe662",
      "old_mode": 33188,
      "old_path": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java",
      "new_id": "3650fb3cc9f193ac5562dbf104fd316c3cb3e6a1",
      "new_mode": 33188,
      "new_path": "services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java"
    },
    {
      "type": "modify",
      "old_id": "496abce739a7cb35a893d460aafed83c96f2e9f3",
      "old_mode": 33188,
      "old_path": "services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java",
      "new_id": "012bf28d00c2dd9011c8ef46d305a2176d7221e7",
      "new_mode": 33188,
      "new_path": "services/tests/servicestests/src/com/android/server/devicepolicy/DevicePolicyManagerTest.java"
    }
  ]
}