)]}'
{
  "commit": "9cb177301fdab492e4cfef376b28339afe3ef663",
  "tree": "a09bfc6bd389bcf9bee6fd9b890a970abc969d26",
  "parents": [
    "069c3c0908dfa8418753d0c25890a9d4fb67178d"
  ],
  "author": {
    "name": "Matt Caswell",
    "email": "matt@openssl.org",
    "time": "Thu Feb 25 13:09:46 2016 +0000"
  },
  "committer": {
    "name": "Matt Caswell",
    "email": "matt@openssl.org",
    "time": "Thu Feb 25 22:45:58 2016 +0000"
  },
  "message": "Fix memory issues in BIO_*printf functions\n\nThe internal |fmtstr| function used in processing a \"%s\" format string\nin the BIO_*printf functions could overflow while calculating the length\nof a string and cause an OOB read when printing very long strings.\n\nAdditionally the internal |doapr_outch| function can attempt to write to\nan OOB memory location (at an offset from the NULL pointer) in the event of\na memory allocation failure. In 1.0.2 and below this could be caused where\nthe size of a buffer to be allocated is greater than INT_MAX. E.g. this\ncould be in processing a very long \"%s\" format string. Memory leaks can also\noccur.\n\nThese issues will only occur on certain platforms where sizeof(size_t) \u003e\nsizeof(int). E.g. many 64 bit systems. The first issue may mask the second\nissue dependent on compiler behaviour.\n\nThese problems could enable attacks where large amounts of untrusted data\nis passed to the BIO_*printf functions. If applications use these functions\nin this way then they could be vulnerable. OpenSSL itself uses these\nfunctions when printing out human-readable dumps of ASN.1 data. Therefore\napplications that print this data could be vulnerable if the data is from\nuntrusted sources. OpenSSL command line applications could also be\nvulnerable where they print out ASN.1 data, or if untrusted data is passed\nas command line arguments.\n\nLibssl is not considered directly vulnerable. Additionally certificates etc\nreceived via remote connections via libssl are also unlikely to be able to\ntrigger these issues because of message size limits enforced within libssl.\n\nCVE-2016-0799\n\nIssue reported by Guido Vranken.\n\nReviewed-by: Andy Polyakov \u003cappro@openssl.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f45fb10deb31c602f9bc682e131f2ea05263e020",
      "old_mode": 33188,
      "old_path": "crypto/bio/b_print.c",
      "new_id": "17ea8af6784889ed15bacd218351b757d42509d5",
      "new_mode": 33188,
      "new_path": "crypto/bio/b_print.c"
    }
  ]
}