)]}'
{
  "commit": "01cb44f098bee1fe8c8e1106d5927ea1aa58a00e",
  "tree": "833d72602226e0a1118b83634e2ce0fc0a08652e",
  "parents": [
    "1af205db6af0c9d22342d5aacd95c5d09c40bf90"
  ],
  "author": {
    "name": "Brian Delwiche",
    "email": "delwiche@google.com",
    "time": "Wed Jun 24 15:02:03 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 17:46:30 2026 -0700"
  },
  "message": "Fix cross-thread UAF in AvrcpService updates\n\nA Use-After-Free (UAF) vulnerability exists in the Android Bluetooth AVRCP service due to a cross-thread race condition. Releasing the final `shared_ptr\u003cDevice\u003e` reference on a non-owning thread (e.g., the Java MainLooper thread) could race against a queued `WeakPtr` task executing on the `bt_main_thread` during a disconnection, leading to potential memory corruption.\n\nThis commit resolves the issue by posting the device iteration via `do_in_main_thread` in `SendMediaUpdate`, `SendFolderUpdate`, and `SendPlayerSettingsChanged`. This ensures that the temporary vector returned by `GetListOfDevices()`, which holds `shared_ptr\u003cDevice\u003e` references, is allocated and destroyed strictly on the `bt_main_thread`. The `shared_ptr` lifecycle remains single-threaded, enforcing the libchrome `WeakPtr` thread-safety contract. Additionally, the `instance_` and `connection_handler_` null checks are moved inside the lambdas to safely evaluate them on the execution thread.\n\nTest: atest net_test_avrcp --host\n\nBug: 522373202\nFlag: EXEMPT BUGFIX\nThis was autogenerated by MendIt (go/androidmendit)\n\n(cherry picked from commit 367ae26e2e4d7f36e01746f13213f23679098f59)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:66c1ec113f7b5924c3c48cbecabd2f29b986bc76\nMerged-In: Idc1f9252227c37b013b477f4873d49a04b403c23\nChange-Id: Idc1f9252227c37b013b477f4873d49a04b403c23\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8cb5c98956431daffdc801f4af572f1bb060011a",
      "old_mode": 33188,
      "old_path": "system/btif/avrcp/avrcp_service.cc",
      "new_id": "c332046694e428fbc93df78fd896f037f86128e7",
      "new_mode": 33188,
      "new_path": "system/btif/avrcp/avrcp_service.cc"
    }
  ]
}