)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"291cb35238cec6ac236bf61163eb4818a7afefe3","unresolved":true,"context_lines":[{"line_number":15,"context_line":"the decrement has already wrapped it to SIZE_MAX, so the field is left"},{"line_number":16,"context_line":"corrupted. The next reset then does"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    o-\u003edomain_search_list[SIZE_MAX] \u003d NULL"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"and walks far out of bounds, writing NULL through each slot. A server"},{"line_number":21,"context_line":"can drive this reset path against a client with PUSH_UPDATE, so on"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7bc87ed3_c5700913","line":18,"updated":"2026-09-13 09:43:36.000000000","message":"This is not true. `domain_search_list_len` is not `size_t`. It is `unsigned int` and wraps to `UINT_MAX`.","commit_id":"7a0342ba24ad6d46a9afd3bb0e128829450cd455"}],"src/openvpn/options.c":[{"author":{"_account_id":1000053,"name":"razvanc","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"291cb35238cec6ac236bf61163eb4818a7afefe3","unresolved":true,"context_lines":[{"line_number":3781,"context_line":"        while (o-\u003edomain_search_list_len \u003e 0)"},{"line_number":3782,"context_line":"        {"},{"line_number":3783,"context_line":"            o-\u003edomain_search_list[--(o-\u003edomain_search_list_len)] \u003d NULL;"},{"line_number":3784,"context_line":"        }"},{"line_number":3785,"context_line":"        o-\u003edisable_nbt \u003d 0;"},{"line_number":3786,"context_line":"        o-\u003edhcp_options \u003d 0;"},{"line_number":3787,"context_line":"        CLEAR(options-\u003edns_options.from_dhcp);"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"b78d0c03_9dc5cd4e","line":3784,"updated":"2026-09-13 09:43:36.000000000","message":"If understand this correctly, the following would just remove the loop, and with it this whole class of bug:\n\n```\no-\u003edomain_search_list_len \u003d 0;\nCLEAR(o-\u003edomain_search_list);\n```\n\nThis seems to be prevailing idiom in the rest of the file for similar fields, not sure what made this case special.","commit_id":"7a0342ba24ad6d46a9afd3bb0e128829450cd455"}]}