)]}'
{
  "commit": "c077ffbe609c33adc212b73cd3018b174f0c8f89",
  "tree": "a8cea23c08290e671084462158e96229deb67db3",
  "parents": [
    "e6d1eec3eaf422ccfcf0b7f91c263f4885440af5"
  ],
  "author": {
    "name": "Brian Delwiche",
    "email": "delwiche@google.com",
    "time": "Wed Mar 29 22:52:06 2023 +0000"
  },
  "committer": {
    "name": "Brian Delwiche",
    "email": "delwiche@google.com",
    "time": "Wed Mar 29 22:52:06 2023 +0000"
  },
  "message": "Fix OOB read in btm_ble_periodic_av_sync_lost\n\nbtm_ble_periodic_av_sync_lost internally calls the function\nbtm_ble_get_psync_index_from_handle, which polls the internal periodic\nsync buffer and returns a matching index if one exists.  If no matching\nhandle is found, it returns MAX_SYNC_TRANSACTION.\n\nHowever, here the calling function lacks the check for this case present\nin similar functions.  If no handle is matched, it will attempt to index\nthe buffer with MAX_SYNC_TRANSACTION, which will overrun it by a single\nwidth and lead to OOB access.\n\nAdd handling for this case.\n\nBug: 273502002\nTest: atest bluetooth_test_gd_unit, atest net_test_stack_btm, validated\nagainst researcher POC\nTag: #security\nIgnore-AOSP-First: Security\n\nChange-Id: I2e1e95b277f81b2668f721a7693df50841968ec5\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a4dca67e17bbaa0efe0aeb171456c7a786266ce5",
      "old_mode": 33188,
      "old_path": "system/stack/btm/btm_ble_gap.cc",
      "new_id": "04047bbebc65972638d21346b534d8c89dc0baa1",
      "new_mode": 33188,
      "new_path": "system/stack/btm/btm_ble_gap.cc"
    }
  ]
}