)]}'
{
  "commit": "d6cb6aefb12713d2d470e680c01cd1688d75efa2",
  "tree": "adf3bed1bd37d84ea75978dfd6b8a0e8fc8282a5",
  "parents": [
    "b4957d82aec3de3ac816f6b0e416abb48a29bd57"
  ],
  "author": {
    "name": "Kyle Hsiao",
    "email": "kylehsiao@google.com",
    "time": "Mon Jun 22 20:47:21 2026 -0700"
  },
  "committer": {
    "name": "Android Build Coastguard Worker",
    "email": "android-build-coastguard-worker@google.com",
    "time": "Mon Jul 13 18:05:48 2026 -0700"
  },
  "message": "Fix out-of-bounds write in NFC activation handling\n\nWhen an NFCC sends a short RF_INTF_ACTIVATED_NTF packet, a parsing failure can bypass the initialization of a tech parameter union on the stack. This uninitialized stack data is later used as a length parameter for a memcpy, leading to an out-of-bounds write in the NFC process that can corrupt function pointers.\n\nThis commit resolves the issue by fully zero-initializing the `evt_data.activate` structure in `nfc_ncif_proc_activate()`, preventing uninitialized stack memory from being passed to the callback path. Furthermore, it adds a bounds check in `nfa_dm_notify_activation_status()` to clamp `nfcid_len` to `NCI_NFCID1_MAX_LEN` when decoding the `NFC_DISCOVERY_TYPE_POLL_A` parameter block, mitigating unbounded writes.\n\nTest: Built libnfc-nci module and ran alint.\n\nBug: 522373576\nFlag: EXEMPT BUGFIX\nThis was autogenerated by MendIt (go/androidmendit)\n\n(cherry picked from commit f974b0fee85ff9910610f913e64df59c827cdaf7)\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:69e0da3fdbebcac18f6865136f1d76e71e579c80\nMerged-In: Iedd07da2dd238a27550c8d8bdfa9ab8d4cd1050f\nChange-Id: Iedd07da2dd238a27550c8d8bdfa9ab8d4cd1050f\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "95769ea68a822b06f1267486ff58fdcd00a276c2",
      "old_mode": 33188,
      "old_path": "libnfc-nci/src/nfa/dm/nfa_dm_act.cc",
      "new_id": "29a6fb0a8dadde8ef334ea7fbb3ab3c944b366dd",
      "new_mode": 33188,
      "new_path": "libnfc-nci/src/nfa/dm/nfa_dm_act.cc"
    },
    {
      "type": "modify",
      "old_id": "a1595caed9d3fc858171431ce33ca45c5a21158f",
      "old_mode": 33188,
      "old_path": "libnfc-nci/src/nfc/nfc/nfc_ncif.cc",
      "new_id": "b42224f9d975fd81ed82430ef7bf9001c21eaaba",
      "new_mode": 33188,
      "new_path": "libnfc-nci/src/nfc/nfc/nfc_ncif.cc"
    }
  ]
}