)]}'
{
  "commit": "770130659b6fb2acf271476579a3644e093dda7f",
  "tree": "668352a12fb2461542e8c4e6848587c9ad4c0a5f",
  "parents": [
    "9c075b7c71703f6c4d815c5f7d5177476412c2ca"
  ],
  "author": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Tue Dec 04 22:23:22 2018 -0500"
  },
  "committer": {
    "name": "Dmitri Shuralyov",
    "email": "dmitshur@golang.org",
    "time": "Fri Dec 14 01:04:07 2018 +0000"
  },
  "message": "crypto/x509: limit number of signature checks for each verification\n\nThat number grows quadratically with the number of intermediate\ncertificates in certain pathological cases (for example if they all have\nthe same Subject) leading to a CPU DoS. Set a fixed budget that should\nfit all real world chains, given we only look at intermediates provided\nby the peer.\n\nThe algorithm can be improved, but that\u0027s left for follow-up CLs:\n\n    * the cache logic should be reviewed for correctness, as it seems to\n      override the entire chain with the cached one\n    * the equality check should compare Subject and public key, not the\n      whole certificate\n    * certificates with the right SKID but the wrong Subject should not\n      be considered, and in particular should not take priority over\n      certificates with the right Subject\n\nFixes #29233\n\nChange-Id: Ib257c12cd5563df7723f9c81231d82b882854213\nReviewed-on: https://team-review.git.corp.google.com/c/370475\nReviewed-by: Andrew Bonventre \u003candybons@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/154105\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nRun-TryBot: Filippo Valsorda \u003cfilippo@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7cc1dd4eb6f017aad35d9dbd0981e99883be4ac3",
      "old_mode": 33188,
      "old_path": "src/crypto/x509/cert_pool.go",
      "new_id": "7c55c3b4a3286c36f65cf14c538fb86eb6076ad7",
      "new_mode": 33188,
      "new_path": "src/crypto/x509/cert_pool.go"
    },
    {
      "type": "modify",
      "old_id": "ea78ab123f202be9d5218ebadae9b3194293adad",
      "old_mode": 33188,
      "old_path": "src/crypto/x509/verify.go",
      "new_id": "56b7948c4155297b2ac18774489892c77cc8234f",
      "new_mode": 33188,
      "new_path": "src/crypto/x509/verify.go"
    },
    {
      "type": "modify",
      "old_id": "0e24d3b5da3af3218f8d63992811ef674eba1ba8",
      "old_mode": 33188,
      "old_path": "src/crypto/x509/verify_test.go",
      "new_id": "85f4703d4c3fd2b88e471825b8e2989491709944",
      "new_mode": 33188,
      "new_path": "src/crypto/x509/verify_test.go"
    }
  ]
}