)]}' { "commit": "d53b2c3c88e6044ce26df51d48ca6fd02023230a", "tree": "b87ee4185d4f9cc38dc04a9747ceedc322a1082c", "parents": [ "4df48dd30fceb6615389bb12f160eb5d57c8df99" ], "author": { "name": "Brian Smith", "email": "brian@briansmith.org", "time": "Tue Mar 17 00:37:06 2015 -1000" }, "committer": { "name": "Adam Langley", "email": "agl@google.com", "time": "Tue Mar 17 19:12:54 2015 +0000" }, "message": "Fix out-of-bounds memory write in speed.cc.\n\nWindows x64 uses the IL32P64 data model, which means that unsigned int\nis 32 bits and size_t is 64 bits. Previously, the expression\n|~(alignment - 1)| resulted in the 32-bit value 0xFFFFFFF0, which was\nthen extended to the 64-bit value 0x00000000FFFFFFF0 when promoted to\nsize_t. When the input pointer was masked with this value, the result\nwas a pointer that was usually way outside the boundaries of the array.\n\nThe new code casts |alignment| to size_t first prior to the bitwise\nnegation, resulting in the correct mask value of 0xFFFFFFFFFFFFFFF0.\n\nChange-Id: I04754aa9e1ce7a615c2b4c74051cfcca38dbb52f\nReviewed-on: https://boringssl-review.googlesource.com/3961\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "2df6f90142af2958bfe820e519402ff008cded2f", "old_mode": 33188, "old_path": "tool/speed.cc", "new_id": "dbaaf46558a4f439d6356b3811f705b9a667a8f1", "new_mode": 33188, "new_path": "tool/speed.cc" } ] }