)]}'
{
  "commit": "09ae4e14509f863eabe7bde721f5e8e3ffa14412",
  "tree": "7618af1edd98c7f710dffd88fcb63c8b36eb0f84",
  "parents": [
    "022ac90c296b847406f664f663b20416fc57e1ee"
  ],
  "author": {
    "name": "Brian Delwiche",
    "email": "delwiche@google.com",
    "time": "Fri Apr 05 00:41:49 2024 +0000"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Wed Mar 12 16:51:23 2025 -0700"
  },
  "message": "Fix OOB read in bta_av_setconfig_rej\n\nThe bta_av_config_ind function in bta_av_aact.cc makes a call in some\nuser journeys to bta_av_setconfig_rej, constructing its p_data argument\n(a union datatype) as a tBTA_AV_CI_SETCONFIG.  This is a valid member of\nthe union, but bta_av_setconfig_rej makes the assumption that the\nvariable being passed has been set up as a tBTA_AV_STR_MSG, which is not\ntrue in this case.  This causes OOB access.\n\nDraw the required data instead from the stream control block, which\nshould not be subject to this confusion.\n\nBug: 260230151\nTest: m libbluetooth\nTest: manual\nIgnore-AOSP-First: security\nTag: #security\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:b1d0907e7038254c722e14c5681fa3542dccf9db)\nMerged-In: Id6cdb2b5a5e0b25d0926a83d09b68c483bd0df98\nChange-Id: Id6cdb2b5a5e0b25d0926a83d09b68c483bd0df98\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fc5e55bb6f7188c2ba075ef90e12f4bbfcf6b3ec",
      "old_mode": 33188,
      "old_path": "system/bta/av/bta_av_aact.cc",
      "new_id": "c76f41112ae25570a1a977bbec09944bf4a1c2fa",
      "new_mode": 33188,
      "new_path": "system/bta/av/bta_av_aact.cc"
    }
  ]
}