)]}'
{
  "commit": "8545051c3652bce7bb962afcb6879c4a6288bc67",
  "tree": "03f47ed1bb5c20496f6ed891540e0490265791df",
  "parents": [
    "79b4444d81e2b9f21c60d7bf6511200e3e41d6fd"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Mon Sep 18 16:51:56 2017 -0400"
  },
  "committer": {
    "name": "Andy Polyakov",
    "email": "appro@openssl.org",
    "time": "Fri Sep 22 22:00:55 2017 +0200"
  },
  "message": "Guard against DoS in name constraints handling.\n\nThis guards against the name constraints check consuming large amounts\nof CPU time when certificates in the presented chain contain an\nexcessive number of names (specifically subject email names or subject\nalternative DNS names) and/or name constraints.\n\nName constraints checking compares the names presented in a certificate\nagainst the name constraints included in a certificate higher up in the\nchain using two nested for loops.\n\nMove the name constraints check so that it happens after signature\nverification so peers cannot exploit this using a chain with invalid\nsignatures. Also impose a hard limit on the number of name constraints\ncheck loop iterations to further mitigate the issue.\n\nThanks to NCC for finding this issue. Fix written by Martin Kreichgauer.\n\nReviewed-by: Rich Salz \u003crsalz@openssl.org\u003e\nReviewed-by: Andy Polyakov \u003cappro@openssl.org\u003e\n(Merged from https://github.com/openssl/openssl/pull/4393)\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fd297e2082e4911ab9dd4013d3bacc06fe5b7251",
      "old_mode": 33188,
      "old_path": "crypto/x509/x509_vfy.c",
      "new_id": "d4a5f3a6ba418f7028d58b8a768e7a32f7af398b",
      "new_mode": 33188,
      "new_path": "crypto/x509/x509_vfy.c"
    },
    {
      "type": "modify",
      "old_id": "7731bacd0493329bb509472efda5305f2e6fb81c",
      "old_mode": 33188,
      "old_path": "crypto/x509v3/v3_ncons.c",
      "new_id": "561128e3faddeb8bef86fd90a8e5e135e4373db5",
      "new_mode": 33188,
      "new_path": "crypto/x509v3/v3_ncons.c"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "13b8ab29b68b2138ba253234f01225881358821f",
      "new_mode": 33188,
      "new_path": "test/certs/many-constraints.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "cf6a0df3c662308c194388442c1a4becd7091ef6",
      "new_mode": 33188,
      "new_path": "test/certs/many-names1.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "842ac608963bb01f06898b89b41635ab87278181",
      "new_mode": 33188,
      "new_path": "test/certs/many-names2.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "dbfa04281945215f71bdbc8f91fc9a6cfc068496",
      "new_mode": 33188,
      "new_path": "test/certs/many-names3.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "21eed833865b8e09fd27c3c99a987f628cd18b92",
      "new_mode": 33188,
      "new_path": "test/certs/some-names1.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "328e3d1621d1a984797bbed39e61705917b67abb",
      "new_mode": 33188,
      "new_path": "test/certs/some-names2.pem"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "a6d3ee790dfc90be3202c61ad77d25c7658511d5",
      "new_mode": 33188,
      "new_path": "test/certs/some-names3.pem"
    },
    {
      "type": "modify",
      "old_id": "001d37a51bc9cafeeef4fe462358d81a911a0a02",
      "old_mode": 33188,
      "old_path": "test/recipes/25-test_verify.t",
      "new_id": "4d3e8963d13f3a7016eed5b0d4e97a7b72f911c4",
      "new_mode": 33188,
      "new_path": "test/recipes/25-test_verify.t"
    }
  ]
}