)]}'
{
  "commit": "33be5d45cb275aa9c13d975a4c556b2e7a769089",
  "tree": "7a6ad7d88976152837c61c95792a588270af7da6",
  "parents": [
    "69d5cc1b78829e3dd141c20dc7ab5c0137da3a4e"
  ],
  "author": {
    "name": "Brian Delwiche",
    "email": "delwiche@google.com",
    "time": "Thu Apr 03 17:16:55 2025 +0000"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Tue Aug 12 18:50:47 2025 -0700"
  },
  "message": "Fix use after free in acl_arbiter\n\nIn SendPacketToPeer of acl_arbiter.cc, a buffer length is logged in one\ncase after an intermediate call may free the buffer, leading to use\nafter free.\n\nLog instead from the buffer\u0027s source, which has not been freed at this\npoint in the code.\n\nBug: 406785684\nFlag: EXEMPT obvious logic fix\nTest: m libbluetooth\nTest: researcher POC\nTag: #security\n(cherry picked from commit 243d7484e59730c522640b616445b2747b3062e5)\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:d6cb1ec8d11d2a8239c9f7e824f6fbe29edeb2e6)\nMerged-In: Idd13399c24399d01bcd668a4b779ef1980273691\nChange-Id: Idd13399c24399d01bcd668a4b779ef1980273691\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a9c09deff4e4a6cd37e1be9a39d5ca6c129a5168",
      "old_mode": 33188,
      "old_path": "system/stack/arbiter/acl_arbiter.cc",
      "new_id": "5f37965e98839661799d725d2cb2eccee19a83e9",
      "new_mode": 33188,
      "new_path": "system/stack/arbiter/acl_arbiter.cc"
    }
  ]
}