)]}'
{
  "commit": "f92b7bca985205082c86140d0bd7c86c5be00efc",
  "tree": "6ec160179a5193c90b13b5aa72d70ca9321ad69b",
  "parents": [
    "19b4e5701712f74d005cc66a36374559e8dfd281"
  ],
  "author": {
    "name": "Catherine L",
    "email": "catherine.l@intel.com",
    "time": "Fri Oct 23 11:30:26 2026 +0530"
  },
  "committer": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Mon Nov 02 17:09:01 2026 -0500"
  },
  "message": "Bluetooth: btintel: fix buffer over-read in fw payload\n\nThe firmware decoder cast fw_ptr + frag_len to struct\nhci_command_hdr and read cmd-\u003eplen before confirming the\nheader and payload still fit in the remaining firmware\nbuffer.\n\nAdd explicit bounds checks before each dereference:\n1. Reject if the command header is not fully contained\n   in remain.\n2. Reject if the full command including payload exceeds\n   remain.\n3. Log the offending fragment length and remaining size\n   before returning -EINVAL.\n\nFixes: fbbe83c52bc0d (\"Bluetooth: btintel: Create common function for firmware download\")\nSigned-off-by: Catherine L \u003ccatherine.l@intel.com\u003e\nTested-by: Kiran K \u003ckiran.k@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0709fb3212f9699e24aab14c980e39a24d3d08dc",
      "old_mode": 33188,
      "old_path": "drivers/bluetooth/btintel.c",
      "new_id": "929018428c1924f7be3c6f877f009c52aa132dea",
      "new_mode": 33188,
      "new_path": "drivers/bluetooth/btintel.c"
    }
  ]
}