)]}'
{
  "commit": "fe8ae458fe5e09e39a635719a8c2ec5393d0e815",
  "tree": "e47d8fba0c13d63cd1f18c87c22db8aafed912a4",
  "parents": [
    "542a3d9571611fd83b47afa41e76e7c6c7b3f991"
  ],
  "author": {
    "name": "mohammadmseet-hue",
    "email": "mohammadmseet@gmail.com",
    "time": "Sat Apr 04 05:17:44 2026 +0000"
  },
  "committer": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Thu May 21 10:27:54 2026 -0700"
  },
  "message": "tiff: limit PackBits decompression output size\n\nunpackBits has no output size limit. readBuf, which is used\nfor LZW, Deflate, and CCITT decompression, enforces a limit,\nbut the PackBits path bypasses readBuf entirely. This allows\na 2MB TIFF with PackBits compression to decompress to 745MB\n(372x amplification).\n\nCVE-2023-29408 added decompression size limits for other\nformats but did not cover PackBits. This change adds a limit\nparameter to unpackBits matching blockMaxDataSize, consistent\nwith the existing readBuf approach.\n\nUpdates golang/go#61582\n\nChange-Id: I659f1da32bd415e4cf15a6061cb9ceee7a45f2af\nGitHub-Last-Rev: 2e5fbdbb124d3f2d71ac5a204831dbaa2f8a77ce\nGitHub-Pull-Request: golang/image#29\nReviewed-on: https://go-review.googlesource.com/c/image/+/759960\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nigel Tao \u003cnigeltao@google.com\u003e\nReviewed-by: Nigel Tao \u003cnigeltao@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3f176f00a90a05ec5cbea36b5ade4e1463dd012b",
      "old_mode": 33188,
      "old_path": "tiff/compress.go",
      "new_id": "1520b571b3c0c165271f2e251fdcea8949165438",
      "new_mode": 33188,
      "new_path": "tiff/compress.go"
    },
    {
      "type": "modify",
      "old_id": "882899d8593efc859677d45cfd46ef15fe7ad1a1",
      "old_mode": 33188,
      "old_path": "tiff/reader.go",
      "new_id": "297a4cf87e23ea635f70c1b0f6f9e3c6d494e06a",
      "new_mode": 33188,
      "new_path": "tiff/reader.go"
    },
    {
      "type": "modify",
      "old_id": "4709b0dd732e6e1e79826ef20ff3d4a0a0c36d58",
      "old_mode": 33188,
      "old_path": "tiff/reader_test.go",
      "new_id": "e5bf714765440dde8fa99c2024385adc508be33a",
      "new_mode": 33188,
      "new_path": "tiff/reader_test.go"
    }
  ]
}