)]}'
{
  "commit": "b79e5fd8cf140eb95b1cae6b52d35ee81eb2543e",
  "tree": "0d59b42fd7b1522aa5798fa0db5e2c114ebf5357",
  "parents": [
    "92d884176dcd6c93ac0fd48b97ef24751128ad1d"
  ],
  "author": {
    "name": "Kyle Hsiao",
    "email": "kylehsiao@google.com",
    "time": "Wed May 27 01:23:26 2026 +0000"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Fri Jul 10 08:29:56 2026 -0700"
  },
  "message": "Fix OOB write in rw_mfc_handle_read_op\n\nBuganizer issue b/503557185 reports a heap buffer overflow vulnerability in com.android.nfc during Mifare Classic NDEF reads.\n\nThis CL adds a rollback mechanism that snapshots the ndef_length and\nndef_start_pos before TLV decoding. It validates the new length and\nrestores the original values if inflation is detected. Control flow is also updated to prevent further block reads upon failure.\n\nBug: 503557185\nBug: 503553866\nTest: manual\nFlag: EXEMPT BUGFIX\n(cherry picked from commit 50df1ba6f310a3947ff257d5fee24bb2b371af0c)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:d4544123ea3b152053f9abcb95fd2a2833b8fb72\nMerged-In: I2e26dfa48e96c5fee4bbff14c0b0b7be81d19213\nChange-Id: I2e26dfa48e96c5fee4bbff14c0b0b7be81d19213\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "604a7a6dd5b6115f046f285cc83c319e45e04353",
      "old_mode": 33188,
      "old_path": "libnfc-nci/src/nfc/tags/rw_mfc.cc",
      "new_id": "62c6eb85945a4ae7e0d9cf48551ac320081b90b3",
      "new_mode": 33188,
      "new_path": "libnfc-nci/src/nfc/tags/rw_mfc.cc"
    }
  ]
}