)]}'
{
  "commit": "e976e4349d693b4bbb97e1694f45be5a1b22c8c7",
  "tree": "cd953431a4ce85ec73195d91ea1e8eef8508c929",
  "parents": [
    "f48fcaf9010a04f2616174b6d61d321bdb21b791"
  ],
  "author": {
    "name": "Adam Langley",
    "email": "alangley@gmail.com",
    "time": "Mon Feb 15 14:01:10 2016 -0800"
  },
  "committer": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Thu Feb 18 15:45:48 2016 +0000"
  },
  "message": "Don\u0027t read uninitialised data for short session IDs.\n\nWhile it\u0027s always safe to read |SSL_MAX_SSL_SESSION_ID_LENGTH| bytes\nfrom an |SSL_SESSION|\u0027s |session_id| array, the hash function would do\nso with without considering if all those bytes had been written to.\n\nThis change checks |session_id_length| before possibly reading\nuninitialised memory. Since the result of the hash function was already\nattacker controlled, and since a lookup of a short session ID will\nalways fail, it doesn\u0027t appear that this is anything more than a clean\nup.\n\nBUG\u003d586800\n\nChange-Id: I5f59f245b51477d6d4fa2cdc20d40bb6b4a3eae7\nReviewed-on: https://boringssl-review.googlesource.com/7150\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0a3c8f71f4389d4a8fa73cb1136eae44b2a85703",
      "old_mode": 33188,
      "old_path": "ssl/ssl_lib.c",
      "new_id": "b72601172e6d7e27bbe5282dfaaf673c89a74e65",
      "new_mode": 33188,
      "new_path": "ssl/ssl_lib.c"
    }
  ]
}