)]}'
{
  "commit": "38cc06501f91fbcaebb397fc6ca81bf1b4d5c11e",
  "tree": "f6f0d13c0329f56d6b6b519f8b5e4c48ae1af7f7",
  "parents": [
    "d6cb6aefb12713d2d470e680c01cd1688d75efa2"
  ],
  "author": {
    "name": "TYM Tsai",
    "email": "tymtsai@google.com",
    "time": "Thu Jun 04 06:20:45 2026 +0000"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 18:05:57 2026 -0700"
  },
  "message": "Fix integer underflow in rw_ci_data_cback\n\nThis commit addresses an out-of-bounds read vulnerability in the\nrw_ci_data_cback function caused by an integer underflow when handling\nzero-length payloads in RW_CI_STATE_UID and RW_CI_STATE_ATTRIB states.\nBy validating the length of the response before decrementing it, we\nensure the pointer does not go out of bounds.\n\nBug: 503550880\nTest: atest libnfc-nci-tests:RwCiTest\nFlag: EXEMPT BUGFIX\n\n(cherry picked from commit d61d8a670948bfc392e748e07c0542b7b4d372ea)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:52c49e79c36f296597310c68998810735393fd00\nMerged-In: I500f5e8b37376a233e95edc4471766f095cc1786\nChange-Id: I500f5e8b37376a233e95edc4471766f095cc1786\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ab3a7ddbe4d78d4ac349725626d1eefb081fcdce",
      "old_mode": 33188,
      "old_path": "libnfc-nci/src/nfc/tags/rw_ci.cc",
      "new_id": "49c7ad24c4ad94157688231ebe67686a8ed91222",
      "new_mode": 33188,
      "new_path": "libnfc-nci/src/nfc/tags/rw_ci.cc"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "8d2ce93c458013bf2adfdfdc3d58d913234f3b71",
      "new_mode": 33188,
      "new_path": "libnfc-nci/tests/src/rw_ci_test.cc"
    }
  ]
}