)]}'
{
  "commit": "2d66bfa038aa3e575ded86d50525f966a41cf4fa",
  "tree": "650304e62338da99967b602bdac3f8824f28da1d",
  "parents": [
    "2ebc0d49c6d719a435b149bdb0d039f37ada8282"
  ],
  "author": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Thu Aug 27 12:01:01 2026 +0100"
  },
  "committer": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Thu Aug 27 12:01:01 2026 +0100"
  },
  "message": "[crypto] Guard against mutation of certificate chain during validation\n\nCertificate chains are reference-counted structures, and both the TLS\nconnection and the validator hold a reference to the same certificate\nchain while validation is in progress.  The TLS connection will not\nmutate the chain during this time: if a second (illegal) Certificate\nrecord were to arrive then it would drop its reference to the existing\nchain (leaving the validator as the sole possessor) before creating a\nnew chain to hold the received certificates.\n\nThe validator currently holds two pointers that could be invalidated\nif a future code change were to cause the chain to be externally\nmutatated while validation is in progress:\n\n  - a pointer to the current certificate (for OCSP or cross-signed\n    downloads) that does not hold its own reference and relies upon\n    the chain\u0027s reference to keep the certificate pointer valid\n\n  - a pointer to the current link within the certificate chain\n\nGuard against this class of potential future code changes by promoting\nthe certificate pointer to hold its own reference to the certificate\nso that it is guaranteed to remain valid, deleting the stored pointer\nto the current link completely, and adding a function x509_link() that\nis used to locate the certificate link by traversing the chain.\n\nSigned-off-by: Michael Brown \u003cmcb30@ipxe.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "bab195ca804679c49e44f9790fe5bc972c7421e5",
      "old_mode": 33188,
      "old_path": "src/crypto/x509.c",
      "new_id": "111c747753a68ed18302c3aabb4cab4f285f1bfa",
      "new_mode": 33188,
      "new_path": "src/crypto/x509.c"
    },
    {
      "type": "modify",
      "old_id": "360e2b19a2ca587cad5c5d879037e2fdce640707",
      "old_mode": 33188,
      "old_path": "src/include/ipxe/x509.h",
      "new_id": "0b66f958e16d34344cc50035e16c919df12d3c1d",
      "new_mode": 33188,
      "new_path": "src/include/ipxe/x509.h"
    },
    {
      "type": "modify",
      "old_id": "c1f353b2ac7edd8ad6ff9201adda9f6cef973126",
      "old_mode": 33188,
      "old_path": "src/net/validator.c",
      "new_id": "60d4885868b122516d279451688769d2366acbe6",
      "new_mode": 33188,
      "new_path": "src/net/validator.c"
    },
    {
      "type": "modify",
      "old_id": "1a8adc55ec2b6e1415ae369e430026b285d74d4b",
      "old_mode": 33188,
      "old_path": "src/tests/x509_test.c",
      "new_id": "dfee381eb0d637f015653cfac43e3dcebaa9b498",
      "new_mode": 33188,
      "new_path": "src/tests/x509_test.c"
    }
  ]
}