{"push_id":662547041,"size":2,"distinct_size":0,"ref":"refs/heads/maint-0.2.5","head":"8aa04408fb724d55e95419ec9f0568c7d733acb5","before":"6c7720ed49623f649aa6280606c129ee153b04ed","commits":[{"sha":"2b27ce52d2b96a91410fbf8e9c6f2ce7cf036961","author":{"email":"8ff06164d6011c34cde672e44c421d6794d86d20@dereferenced.net","name":"John Brooks"},"message":"Fix out-of-bounds read in INTRODUCE2 client auth\n\nThe length of auth_data from an INTRODUCE2 cell is checked when the\nauth_type is recognized (1 or 2), but not for any other non-zero\nauth_type. Later, auth_data is assumed to have at least\nREND_DESC_COOKIE_LEN bytes, leading to a client-triggered out of bounds\nread.\n\nFixed by checking auth_len before comparing the descriptor cookie\nagainst known clients.\n\nFixes #15823; bugfix on 0.2.1.6-alpha.","distinct":false,"url":"https://api.github.com/repos/torproject/tor/commits/2b27ce52d2b96a91410fbf8e9c6f2ce7cf036961"},{"sha":"8aa04408fb724d55e95419ec9f0568c7d733acb5","author":{"email":"72ea8dfcf31d0eadc9160881a3c0d99a31e0e524@torproject.org","name":"Nick Mathewson"},"message":"Merge branch 'bug15823_025' into maint-0.2.5","distinct":false,"url":"https://api.github.com/repos/torproject/tor/commits/8aa04408fb724d55e95419ec9f0568c7d733acb5"}]}