)]}'
{
  "commit": "d5e93f521b3fd4f57049583a1584d285e5aab16c",
  "tree": "58cfb8abae367e8df5781eaeee3dc7049ca59116",
  "parents": [
    "fc524c161e8640e017b0d838f76e75dc49181e34"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Mon Feb 13 10:21:56 2023 -0500"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Feb 13 17:17:22 2023 +0000"
  },
  "message": "Cap decimal input sizes in s2i_ASN1_INTEGER\n\nDecoding from decimal takes quadratic time, and BN_dec2bn will happily\ndecode however large of input you pass in. This frustrates fuzzers.\n\nI\u0027ve added a cap to the input length in s2i_ASN1_INTEGER for now, rather\nthan BN_dec2bn, because we\u0027ve seen people use BN for surprisingly large\ncalculator operations, and BN generally doesn\u0027t cap inputs to quadratic\n(or worse) algorithms beyond memory limits. (We generally rely on\ncryptography using fixed parameter sizes, though RSA, DSA, and DH were\nmisstandardized and need ad-hoc limits everywhere.)\n\nUpdate-Note: The stringly-typed API for constructing X.509 extensions\nnow has (very generous) maximum input length for decimal integers of\n8,192 digits. If anyone was relying on a higher input, this will break.\nThis is unlikely and should be caught by unit tests; if a project hits\nthis outside of tests, that means they are passing untrusted input into\nthis function, which is a security vulnerability in itself, and means\nthey especially need this change to avoid a DoS.\n\nBug: chromium:1415108\nChange-Id: I138249d23ca6b1996f8437dba98633349bb3042b\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/57205\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e496d82bee4a6640c3d430227e182c5c400c34a2",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_test.cc",
      "new_id": "d80ee197226d878d3e06486d42e19439805202ee",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_test.cc"
    },
    {
      "type": "modify",
      "old_id": "fffb83df2cc557c4818b4529218e98f32cb3527b",
      "old_mode": 33188,
      "old_path": "crypto/x509v3/v3_utl.c",
      "new_id": "7e1ce517ef4d8954d73a1f9e24a04b1d6975393a",
      "new_mode": 33188,
      "new_path": "crypto/x509v3/v3_utl.c"
    },
    {
      "type": "modify",
      "old_id": "633bb9c1105c8ee94eafcdf7fdb7ce1fa196ab3b",
      "old_mode": 33188,
      "old_path": "include/openssl/bn.h",
      "new_id": "1fa499c8f950ff24bbb9e1e02da0df6c5619a57f",
      "new_mode": 33188,
      "new_path": "include/openssl/bn.h"
    }
  ]
}