)]}'
{
  "commit": "1eb9fc572c8670f1554bd7152470c5101d1f1de0",
  "tree": "9ba23bea5bae80b5e72229917026fee2d0d85180",
  "parents": [
    "fdeb1aefefd59806c68704b072fe60862058c55d"
  ],
  "author": {
    "name": "Jeremy Meyer",
    "email": "jakmcbane@google.com",
    "time": "Thu May 21 15:46:02 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 16:35:33 2026 -0700"
  },
  "message": "ResStringPool: Validate styleCount and offsets\n\nResStringPool::setTo fails to validate that the style-index array fits\nwithin the data chunk when stringCount is zero, as it was skipping\nvalidation of stringsStart. An attacker could craft a ResStringPool\nwith a large styleCount and a huge stringsStart, bypassing current\nchecks and leading to an OOB heap read in ResStringPool::styleAt.\n\nThis change:\n1. Validates stringsStart and stylesStart against the total size early.\n2. Improves the styleCount bounds check to ensure the style offset array\n   fits within the chunk and doesn\u0027t overlap with string data.\n\nBug: 499091487\nTest: atest libandroidfw_tests --host\nFlag: EXEMPT BUGFIX\n\n(cherry picked from commit 968cb0736ca65b22a3c7230820912adffa452b1e)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:29ab914cd09d61c347e4a5fc8b14c0d8f83b03b8\nMerged-In: I3e1e4579fbda8ee89c5fea3945d523c6e5b72dc9\nChange-Id: I3e1e4579fbda8ee89c5fea3945d523c6e5b72dc9\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ace38609938ee8a467551f12c87ee36bef6b143a",
      "old_mode": 33188,
      "old_path": "libs/androidfw/ResourceTypes.cpp",
      "new_id": "9f3b7608958e85e8361f03ddccfdaaedae41ba2c",
      "new_mode": 33188,
      "new_path": "libs/androidfw/ResourceTypes.cpp"
    },
    {
      "type": "modify",
      "old_id": "8ef1d0be0a3f2cddd686825e27e406fdd06eb77f",
      "old_mode": 33188,
      "old_path": "libs/androidfw/tests/ResourceTypes_test.cpp",
      "new_id": "0fe6b225e4f32ca07a8502aa8e57bcf5773b1041",
      "new_mode": 33188,
      "new_path": "libs/androidfw/tests/ResourceTypes_test.cpp"
    }
  ]
}