)]}'
{
  "commit": "7e42d365a0c2a82c9a5e6f42c09c329b08d56319",
  "tree": "fb083b5ea367feb4710f5cde61010a28a493991d",
  "parents": [
    "9644b7e34bb0156301cf36b6eb5f6cd542260e8f"
  ],
  "author": {
    "name": "Jeremy Meyer",
    "email": "jakmcbane@google.com",
    "time": "Thu May 21 15:46:02 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 17:42:24 2026 -0700"
  },
  "message": "ResStringPool: Validate styleCount and offsets\n\nResStringPool::setTo fails to validate that the style-index array fits\nwithin the data chunk when stringCount is zero, as it was skipping\nvalidation of stringsStart. An attacker could craft a ResStringPool\nwith a large styleCount and a huge stringsStart, bypassing current\nchecks and leading to an OOB heap read in ResStringPool::styleAt.\n\nThis change:\n1. Validates stringsStart and stylesStart against the total size early.\n2. Improves the styleCount bounds check to ensure the style offset array\n   fits within the chunk and doesn\u0027t overlap with string data.\n\nBug: 499091487\nTest: atest libandroidfw_tests --host\nFlag: EXEMPT BUGFIX\n\n(cherry picked from commit 968cb0736ca65b22a3c7230820912adffa452b1e)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:0aa6ef39a4277197f1a216904fcb8e1c034c4299\nMerged-In: I3e1e4579fbda8ee89c5fea3945d523c6e5b72dc9\nChange-Id: I3e1e4579fbda8ee89c5fea3945d523c6e5b72dc9\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "91c863f4ee7a8e02af851a743b0a20a3216ecf94",
      "old_mode": 33188,
      "old_path": "libs/androidfw/ResourceTypes.cpp",
      "new_id": "133f92e061c232323069d43899a4697901111970",
      "new_mode": 33188,
      "new_path": "libs/androidfw/ResourceTypes.cpp"
    },
    {
      "type": "modify",
      "old_id": "8ef1d0be0a3f2cddd686825e27e406fdd06eb77f",
      "old_mode": 33188,
      "old_path": "libs/androidfw/tests/ResourceTypes_test.cpp",
      "new_id": "0fe6b225e4f32ca07a8502aa8e57bcf5773b1041",
      "new_mode": 33188,
      "new_path": "libs/androidfw/tests/ResourceTypes_test.cpp"
    }
  ]
}