)]}' { "commit": "e6c2a4cdd539b91fd11131f9eecf9bb5087ab55f", "tree": "006fa78f439191920f204adf2b8fc8159731f94f", "parents": [ "3db422c472d5a080580038354d8557357adbdb9c" ], "author": { "name": "Roland Shoemaker", "email": "bracewell@google.com", "time": "Thu Dec 15 10:07:49 2022 -0800" }, "committer": { "name": "Gopher Robot", "email": "gobot@golang.org", "time": "Tue Feb 14 17:44:59 2023 +0000" }, "message": "tiff: don\u0027t pre-allocate giant slices before reading\n\nUse a copy of the standard libraries internal/saferio.ReadDataAt func to\ncreate/read slices which have lengths supplied by the header. This\navoids allocating giant slices which we then learn there are not enough\nbytes in the reader to fill. This makes DecodeConfig safe to use to\ndetermine if the image is of a reasonable size to call Decode on.\n\nThis was found by the ngolo-fuzzing project running on OSS-Fuzz and\nreported by Philippe Antoine (Catena cyber).\n\nFixes golang/go#58003\nFixes CVE-2022-41727\n\nChange-Id: Iae53f78b840f3b8dbeab37fba8c0164054cbb4ed\nReviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1680712\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nTryBot-Result: Security TryBots \u003csecurity-trybots@go-security-trybots.iam.gserviceaccount.com\u003e\nRun-TryBot: Roland Shoemaker \u003cbracewell@google.com\u003e\nReviewed-by: Julie Qiu \u003cjulieqiu@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/image/+/468195\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nRun-TryBot: Roland Shoemaker \u003croland@golang.org\u003e\nTryBot-Result: Gopher Robot \u003cgobot@golang.org\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "de73f4b996b53280f23537087c8a66390aab276c", "old_mode": 33188, "old_path": "tiff/reader.go", "new_id": "45cc056f41c6d65aa20c0096d66b2df7cd3b04c8", "new_mode": 33188, "new_path": "tiff/reader.go" } ] }