)]}'
{
  "commit": "ec367874c272ca5e1f18f7edb925b5350880aa0b",
  "tree": "5a1e8f1407abeebc061f51634e103ab7999a5d40",
  "parents": [
    "1f32d6223dbae156c6b7456631d2d68c2d9a6b0c"
  ],
  "author": {
    "name": "Jonas Oreland",
    "email": "jonaso@webrtc.org",
    "time": "Fri May 22 00:23:54 2026"
  },
  "committer": {
    "name": "webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "webrtc-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Fri May 22 14:41:16 2026"
  },
  "message": "Fix potential UAF in StunDictionaryWriter::CreateDelta + heap exhaustion in StunDictionaryView::ApplyDelta\n\n1) The UAF is possible if Write used Set + Delete in same Delta,\nwhen later cleaning the delta (in ApplyDeltaAck) the state was\nleft inconsistently so that subsequent CreateDelta could experience\nUAF. It is theoretically possible that an actual WebRTC program could do\nthis, but I\u0027m quite certain we currently *dont* use Delete.\n\n2) The heap exhaustion in StunDictionaryView::ApplyDelta after\ncrafting a malicious delta. This is not possible to do with existing\ncode, but obviously an attacker could it learning about the ice\nufra/passwd.\n\nBUG\u003db/513584807,b/513584726\n\nChange-Id: Ic286ad4a7cc6c127fdcd3359505898a36eabdfee\nReviewed-on: https://webrtc-review.googlesource.com/c/src/+/474600\nCommit-Queue: Jonas Oreland \u003cjonaso@webrtc.org\u003e\nReviewed-by: Harald Alvestrand \u003chta@webrtc.org\u003e\nCr-Commit-Position: refs/heads/main@{#47777}\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cc28d8b6ce75825f354a99277b8a8cdbe29a2beb",
      "old_mode": 33188,
      "old_path": "p2p/base/stun_dictionary.cc",
      "new_id": "6974d1d8bf97007669e8a1e86aabefa98462f6d6",
      "new_mode": 33188,
      "new_path": "p2p/base/stun_dictionary.cc"
    },
    {
      "type": "modify",
      "old_id": "506443bee9955fd5cec158b5202c21e28c3c2ad7",
      "old_mode": 33188,
      "old_path": "p2p/base/stun_dictionary_unittest.cc",
      "new_id": "341ed161309adb6ce266d1134cbe5e8eb3b9421b",
      "new_mode": 33188,
      "new_path": "p2p/base/stun_dictionary_unittest.cc"
    }
  ]
}