)]}'
{
  "commit": "23ae9ed61c1d3343fb95015810f62dcbf444976e",
  "tree": "5e370c837c9084b0a67a436434fa06626ca9771d",
  "parents": [
    "e589e60f29d0bbbf6400e250e024f93cbc4961ee"
  ],
  "author": {
    "name": "Andy | ZephrFish",
    "email": "andy@zsec.uk",
    "time": "Mon Mar 23 11:34:39 2026 +0000"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Mon Mar 23 12:58:06 2026 -0700"
  },
  "message": "tiff: cap buffer growth to prevent OOM from malicious IFD offset\n\nA crafted 8-byte TIFF file with IFD offset 0xFFFFFFFF causes\nbuffer.fill() to allocate ~4GB of memory when decoding via\nio.Reader (non-ReaderAt path), leading to an out-of-memory\ncrash in any Go application that calls Decode or DecodeConfig\non untrusted input.\n\nRead the data, and allocate the buffer, in chunks,\nto limit memory allocation to the size of the input file.\n\nReferences: https://issuetracker.google.com/issues/494365189\nFixes golang/go#78267\n\nChange-Id: I514161af87fb3ad24180ec4bed61fa49f491e721\nGitHub-Last-Rev: 8e6d97892cfbdea81fa9e9ec3e3872e4e452aea9\nGitHub-Pull-Request: golang/image#25\nReviewed-on: https://go-review.googlesource.com/c/image/+/757660\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d1801be48eca2706bdec756b04aaa2fce453a232",
      "old_mode": 33188,
      "old_path": "tiff/buffer.go",
      "new_id": "aaf1b06bf1e0c19e601c094c9193fe1355ff1932",
      "new_mode": 33188,
      "new_path": "tiff/buffer.go"
    },
    {
      "type": "modify",
      "old_id": "0e028f6a0fca01586db51fadfaf056b9384a041d",
      "old_mode": 33188,
      "old_path": "tiff/reader_test.go",
      "new_id": "c34ac016df28b4e0f91500a92e8563b56c020a07",
      "new_mode": 33188,
      "new_path": "tiff/reader_test.go"
    }
  ]
}