)]}'
{
  "commit": "96f62ae6e9cb1b123de383fa2542812c9ba3b7db",
  "tree": "f841e83231dc96c870039f1112e09a97164beee8",
  "parents": [
    "13be9020bbbfae457b59b82c999f8c309cb21ffc"
  ],
  "author": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Wed Jul 22 18:07:03 2026 +0200"
  },
  "committer": {
    "name": "Neal Patel",
    "email": "nealpatel@google.com",
    "time": "Thu Aug 13 11:50:47 2026 -0700"
  },
  "message": "sumdb/tlog: fix TileHashReader authentication bypass\n\nTileHashReader\u0027s ReadHashes operates in five stages:\n\n1. it collects the tiles needed to compute the tree hash (stx);\n2. it collects the tiles needed to compute the requested indexes;\n3. if fetches all the tiles from the TileReader;\n4. it authenticates the stx tiles against the tree hash;\n5. it authenticates the remaining tiles against their parents.\n\nAt the collection stage, it deduplicates. So for example if h \u003d 2,\nN \u003d 15, and indexes \u003d [(0, 01)]\n\n                s3\n          ┌───────┴───────┐\n          ∘               ∘              s2        \u003c- 1/000.p/3\n      ┌───┴───┐       ┌───┴───┐       ┌───┴───┐\n      ∘       ∘       ∘       ∘       ∘       ∘      s1     s0\n    ┌─┴─┐   ┌─┴─┐   ┌─┴─┐   ┌─┴─┐   ┌─┴─┐   ┌─┴─┐   ┌─┴─┐    |\n    00  01  02  03  04  05  06  07  08  09  10  11  12  13  14\n\n    └── 0/000 ───┘  └── 0/001 ───┘  └── 0/002 ───┘ └ 0/003.p/3 ┘\n\nthen there are four hashes needed to compute the tree hash\n(s3, s2, s1, s0) which sit in two tiles (1/000.p/3 and 0/003.p/3).\n\nStep 4 authenticates those two tiles against the tree hash. Then step 5\nshould have authenticated tiles[2:] (the remaining tiles) against their\nparents. Instead, it was authenticating tiles[len(stx):], so tiles[4:].\n\nThat means that tiles[2:4] were never authenticated, but were still\n(correctly) used to find hashes for indexes. Those hashes were returned\ncompletely attacker-controlled. The tiles were also passed\nattacker-controlled to SaveTiles, breaking its security contract.\n\nOoof.\n\nAdd a comprehensive test that iterates over all tree sizes in [1, 100]\nand tries to tamper with every index.\n\nFixes CVE-2026-56865\nFixes #80744\n\nChange-Id: I4948dfe06e5c8ba068f7f7edfc215c086a6a6964\nReviewed-on: https://go-review.googlesource.com/c/mod/+/814960\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "153f41c979915d99602dd3b082904d274fe3fa2a",
      "old_mode": 33188,
      "old_path": "sumdb/tlog/tile.go",
      "new_id": "fb0c8d1767cf53fde8a7543f03fd9d424e22ceaf",
      "new_mode": 33188,
      "new_path": "sumdb/tlog/tile.go"
    },
    {
      "type": "modify",
      "old_id": "62b50b7367489ed4cd5927d9074deeceaed339ef",
      "old_mode": 33188,
      "old_path": "sumdb/tlog/tile_test.go",
      "new_id": "b86abb65c98c640d4032b40aaa490894c563f9f8",
      "new_mode": 33188,
      "new_path": "sumdb/tlog/tile_test.go"
    }
  ]
}