)]}'
{
  "commit": "24924dfd30d987047fcdb6b417fd108944c5d09b",
  "tree": "d0b2775ca17137d474690057fe164d7f7e224077",
  "parents": [
    "b93fc576e26f24827ce8121c8cfe9050884dcaea"
  ],
  "author": {
    "name": "Alexey Milovidov",
    "email": "milovidov@clickhouse.com",
    "time": "Sat Oct 03 17:50:21 2026 +0000"
  },
  "committer": {
    "name": "Alexey Milovidov",
    "email": "milovidov@clickhouse.com",
    "time": "Sat Oct 03 17:50:21 2026 +0000"
  },
  "message": "Check the buffer size before reading compact theta sketch preamble fields\n\n`compact_theta_sketch_parser::parse` checks that the buffer holds 8 bytes\nand then, for serial versions 1, 2 and 3, reads `num_entries` (offset 8)\nand `theta` (offset 16) before checking the size again. A truncated\nsketch therefore causes an out-of-bounds read, and the bytes read decide\nwhether the sketch is rejected or accepted as empty: a serial version 1\nor 2 sketch truncated to 8 bytes is accepted as an empty sketch if the\nmemory after the buffer happens to look like an empty preamble.\n\nCheck that the whole preamble is present before reading any field from\nit, which is what the `std::istream` deserializer does implicitly.\n\nFound by the AST fuzzer in ClickHouse:\nhttps://github.com/ClickHouse/ClickHouse/issues/119595\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d728c0a60f63eb80e8d14f35071252f80963aa86",
      "old_mode": 33188,
      "old_path": "theta/include/compact_theta_sketch_parser_impl.hpp",
      "new_id": "a801d1ead36535382b4ad91434c465b99942eb9b",
      "new_mode": 33188,
      "new_path": "theta/include/compact_theta_sketch_parser_impl.hpp"
    },
    {
      "type": "modify",
      "old_id": "96ff7166cf42cc7e086efaca2f284779feadb4af",
      "old_mode": 33188,
      "old_path": "theta/test/theta_sketch_test.cpp",
      "new_id": "adc0713f3c64a951f4abec212870652b42da2286",
      "new_mode": 33188,
      "new_path": "theta/test/theta_sketch_test.cpp"
    }
  ]
}