)]}'
{
  "commit": "c738041c8ce83cca3f4ba643c25629231a5c16a9",
  "tree": "45e3583f56dcaa0ee21a48f7b83c06922c580cb4",
  "parents": [
    "eb524b72724c4c8c1d507a8911e26fabe2f08fef"
  ],
  "author": {
    "name": "Brian Delwiche",
    "email": "delwiche@google.com",
    "time": "Thu Jun 18 19:34:33 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Fri Jul 10 08:13:14 2026 -0700"
  },
  "message": "[RESTRICT AUTOMERGE] Fix SDP server heap buffer overflow\n\nThis change addresses a heap buffer overflow vulnerability in the SDP\nserver where an oversized attribute could be serialized into a fixed\n400-byte allocation during partial attribute responses.\n\nTo prevent out-of-bounds writes and subsequent out-of-bounds reads, this\ncommit enforces strict bounds checks against SDP_MAX_ATTR_LEN across\nthree areas:\n1. Sizing the allocation dynamically in\nsdpu_build_partial_attrib_entry\n   and validating attribute bounds before serialization.\n2. Adding explicit length checks to L2CAP continuation request branches\n   in process_service_attr_req and process_service_search_attr_req.\n3. Enforcing maximum attribute length limits during database insertion\n   in sdp_add_attribute_to_record.\n\nAlso corrects a couple of mistaken bounds checks elsewhere in\nsdp_server.cc.\n\nBug: 503554490\nTest: atest net_test_stack_sdp\nFlag: EXEMPT CVE_FIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:8ee95735c56efb7f6fccc8a6d54bd802fbca64ad\nMerged-In: I3005192b7deb0ce2e259c9abac0077c00a9ebac0\nChange-Id: I3005192b7deb0ce2e259c9abac0077c00a9ebac0\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2b8039800c6c15b04e27d1ba6d16664c4c52a21a",
      "old_mode": 33188,
      "old_path": "system/stack/sdp/sdp_db.cc",
      "new_id": "66d4df65e6a90290e8b790eb938871103ae4f780",
      "new_mode": 33188,
      "new_path": "system/stack/sdp/sdp_db.cc"
    },
    {
      "type": "modify",
      "old_id": "409d3ec1d7ca2061732c52b65d518070c19d91f2",
      "old_mode": 33188,
      "old_path": "system/stack/sdp/sdp_server.cc",
      "new_id": "28afd1851d6b3d2ba67b683aced144f62ecf9c42",
      "new_mode": 33188,
      "new_path": "system/stack/sdp/sdp_server.cc"
    },
    {
      "type": "modify",
      "old_id": "01fd02928799fd43b49a22d11882e6f358dbd14b",
      "old_mode": 33188,
      "old_path": "system/stack/sdp/sdp_utils.cc",
      "new_id": "a43378e418e151404be483dac4d195fd8bffbe59",
      "new_mode": 33188,
      "new_path": "system/stack/sdp/sdp_utils.cc"
    },
    {
      "type": "modify",
      "old_id": "5c9223011ee890e0667d5dc780ed2bcdc458df62",
      "old_mode": 33188,
      "old_path": "system/stack/test/sdp/stack_sdp_test.cc",
      "new_id": "6a468a008d6c295be699e89f5697dec7d8252f95",
      "new_mode": 33188,
      "new_path": "system/stack/test/sdp/stack_sdp_test.cc"
    },
    {
      "type": "modify",
      "old_id": "e3cfac1ddbd98686c192935854dd028980c90b39",
      "old_mode": 33188,
      "old_path": "system/stack/test/sdp/stack_sdp_utils_test.cc",
      "new_id": "b9b688087a941457207f1f4715b6964f1077ac69",
      "new_mode": 33188,
      "new_path": "system/stack/test/sdp/stack_sdp_utils_test.cc"
    }
  ]
}