)]}'
{
  "commit": "3cfc747e26514ae58ddfe4ebdc594c575352f766",
  "tree": "cd7f783ebe0c0432b28740104dc2e0e393537ee4",
  "parents": [
    "b79e5fd8cf140eb95b1cae6b52d35ee81eb2543e"
  ],
  "author": {
    "name": "TYM Tsai",
    "email": "tymtsai@google.com",
    "time": "Wed Jun 03 08:46:34 2026 +0000"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Fri Jul 10 08:30:09 2026 -0700"
  },
  "message": "Fix heap buffer overflow in nfa_t4tnfcee_store_rx_buf\n\nThe NDEF-NFCEE feature lets Android read an NDEF file stored on the eSE/UICC.\nnfa_t4tnfcee_store_rx_buf() drops the received APDU if its length exceeds the\nremaining buffer size. However, this causes the read operation to be truncated,\nwhich might lead to incomplete NDEF data being processed.\n\nTo fix this and prevent the heap buffer overflow, this patch clamps the copy\nsize to the remaining available buffer size rather than dropping the whole\npacket, ensuring that valid data is preserved up to the allocated capacity.\nAdditionally, this prevents a status overwrite in WAIT_READ_FILE that could\nhave masked the failure.\n\nBug: 503545851\nTest: atest libnfc-nci-tests:NfaNfceeActTest\nFlag: EXEMPT BUGFIX\n(cherry picked from commit c51a26973ba862b787b964e0786670507ee3cce7)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:75533f55267b044e1b12e8e40c08d1b4a3d24b4e\nMerged-In: Ie601a3726a0e9e182ce3b759db2873500afb0bd7\nChange-Id: Ie601a3726a0e9e182ce3b759db2873500afb0bd7\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ed95becf268c4632af3810c4360bee66332637e9",
      "old_mode": 33188,
      "old_path": "libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc",
      "new_id": "d16420a9752bfb94de691b7a7ec29a3e341fa967",
      "new_mode": 33188,
      "new_path": "libnfc-nci/src/nfa/ndefnfcee/t4t/nfa_nfcee_act.cc"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "16d609bc09e625462d1af683b2b88042acf8565b",
      "new_mode": 33188,
      "new_path": "libnfc-nci/tests/src/nfa_nfcee_act_test.cc"
    }
  ]
}