)]}'
{
  "commit": "ca9a538aa0f2ebdd261783efa032e69a2ea17fbc",
  "tree": "14529d1f4faf65fadd64b61f1c4c1423b6e0d416",
  "parents": [
    "44e2709cd65fbd2172b9516c79e56f1875f60300"
  ],
  "author": {
    "name": "Adam Langley",
    "email": "agl@google.com",
    "time": "Thu Jan 08 12:26:55 2015 -0800"
  },
  "committer": {
    "name": "Adam Langley",
    "email": "agl@google.com",
    "time": "Fri Jan 09 19:41:59 2015 +0000"
  },
  "message": "Fix various certificate fingerprint issues.\n\nBy using non-DER or invalid encodings outside the signed portion of a\ncertificate the fingerprint can be changed without breaking the signature.\nAlthough no details of the signed portion of the certificate can be changed\nthis can cause problems with some applications: e.g. those using the\ncertificate fingerprint for blacklists.\n\n1. Reject signatures with non zero unused bits.\n\nIf the BIT STRING containing the signature has non zero unused bits reject the\nsignature. All current signature algorithms require zero unused bits.\n\n2. Check certificate algorithm consistency.\n\nCheck the AlgorithmIdentifier inside TBS matches the one in the certificate\nsignature. NB: this will result in signature failure errors for some broken\ncertificates.\n\n3. Check DSA/ECDSA signatures use DER.\n\nReencode DSA/ECDSA signatures and compare with the original received signature.\nReturn an error if there is a mismatch.\n\nThis will reject various cases including garbage after signature (thanks to\nAntti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for\ndiscovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or\nwith leading zeroes).\n\nCVE-2014-8275\n\n(Imported from upstream\u0027s 85cfc188c06bd046420ae70dd6e302f9efe022a9 and\n4c52816d35681c0533c25fdd3abb4b7c6962302d)\n\nChange-Id: Ic901aea8ea6457df27dc542a11c30464561e322b\nReviewed-on: https://boringssl-review.googlesource.com/2783\nReviewed-by: David Benjamin \u003cdavidben@chromium.org\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "62bffdebb123ccb967b17f9197f95374cd8a3e6d",
      "old_mode": 33188,
      "old_path": "crypto/asn1/a_type.c",
      "new_id": "75a17d5c8ad584add927b600fbb785f4657912fd",
      "new_mode": 33188,
      "new_path": "crypto/asn1/a_type.c"
    },
    {
      "type": "modify",
      "old_id": "25d15c05431ebb0073084314c183a7d679624438",
      "old_mode": 33188,
      "old_path": "crypto/dsa/dsa.c",
      "new_id": "47b902acec9443b95a9879f92500860574fb3fe4",
      "new_mode": 33188,
      "new_path": "crypto/dsa/dsa.c"
    },
    {
      "type": "modify",
      "old_id": "ddc3e6173b21868bf422e69a71f27f2be625e960",
      "old_mode": 33188,
      "old_path": "crypto/ecdsa/ecdsa.c",
      "new_id": "644246257ee5f363b75957ab610c795bd4367494",
      "new_mode": 33188,
      "new_path": "crypto/ecdsa/ecdsa.c"
    },
    {
      "type": "modify",
      "old_id": "e728863fe6e054814b3b6c4f74b8c30c52be0684",
      "old_mode": 33188,
      "old_path": "crypto/x509/a_verify.c",
      "new_id": "72e0a627ca29b6fc3a95a812ff9c6600452b4be5",
      "new_mode": 33188,
      "new_path": "crypto/x509/a_verify.c"
    },
    {
      "type": "modify",
      "old_id": "d521281a05636c7ff848308ad136f80c6601b672",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_error.c",
      "new_id": "222a40a3d755554de27679ea8c6fda430d3254c8",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_error.c"
    },
    {
      "type": "modify",
      "old_id": "238b0f34ad4a76f423b07123a7ad58d935c49aef",
      "old_mode": 33188,
      "old_path": "crypto/x509/x_algor.c",
      "new_id": "ae694e3d07f0d12a17b237242e0dffd5923cd2c8",
      "new_mode": 33188,
      "new_path": "crypto/x509/x_algor.c"
    },
    {
      "type": "modify",
      "old_id": "cbc46e27cf8261ee1a0c89c4b0a00f6910de2b60",
      "old_mode": 33188,
      "old_path": "crypto/x509/x_all.c",
      "new_id": "785fd1e4c41ea976496f9cedc45a82cae9e394ae",
      "new_mode": 33188,
      "new_path": "crypto/x509/x_all.c"
    },
    {
      "type": "modify",
      "old_id": "9c606c074ad211e412ab03cfcb2547bd10af5252",
      "old_mode": 33188,
      "old_path": "include/openssl/asn1.h",
      "new_id": "fc12a75532dccd52a06565e3e7469bb2570c219d",
      "new_mode": 33188,
      "new_path": "include/openssl/asn1.h"
    },
    {
      "type": "modify",
      "old_id": "d9c2ae135640db28f2d350dbda9c2b1bdfad6d3b",
      "old_mode": 33188,
      "old_path": "include/openssl/x509.h",
      "new_id": "475f7473173f3314c944ce5ff903e80d8ed85488",
      "new_mode": 33188,
      "new_path": "include/openssl/x509.h"
    }
  ]
}