)]}'
{
  "commit": "3bbf4a659e56fde394e7214ddd17673223aca672",
  "tree": "3231f043801199326cb11910bace3ddfa06d1c12",
  "parents": [
    "6c5fa462eb87ac98bad9b09ea3b041dd770fa611"
  ],
  "author": {
    "name": "John Wright",
    "email": "jsw@google.com",
    "time": "Wed May 22 16:46:48 2024 -0600"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Tue Jun 18 20:19:45 2024 +0000"
  },
  "message": "tiff: Validate palette indices when parsing palette-color images\n\nThe existing implementation will succeed to parse a corrupt or malicious\nimage with color indices out of range of the actual palette, which will\neventually result in a panic when the consumer tries to read the color\nat any corrupted pixel.\n\nThis issue was originally discovered and filed against a downstream\nlibrary: https://github.com/disintegration/imaging/issues/165. This is\nalso referenced in https://osv.dev/vulnerability/GHSA-q7pp-wcgr-pffx.\n\nFixes golang/go#67624\n\nChange-Id: I7d7577adb7d549ecfcd59e84e04a92d198d94c18\nReviewed-on: https://go-review.googlesource.com/c/image/+/588115\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "82a7aa9968bdaa328858080da30f7825f0e98190",
      "new_mode": 33188,
      "new_path": "testdata/invalid-palette-ref.tiff"
    },
    {
      "type": "modify",
      "old_id": "0ad15529095a0f966d014b6036f5eaf63a9dcebd",
      "old_mode": 33188,
      "old_path": "tiff/reader.go",
      "new_id": "1b8fcb8595fbd9326b3248c454f27e49c1f11e18",
      "new_mode": 33188,
      "new_path": "tiff/reader.go"
    },
    {
      "type": "modify",
      "old_id": "4777fd20f2bb6e91dd60ab35b0082c5bf25710fb",
      "old_mode": 33188,
      "old_path": "tiff/reader_test.go",
      "new_id": "0e028f6a0fca01586db51fadfaf056b9384a041d",
      "new_mode": 33188,
      "new_path": "tiff/reader_test.go"
    }
  ]
}