cksum: do not abort on an over-length BLAKE2b digest in a check file - #14508
Open
Dijaa wants to merge 1 commit into
Open
cksum: do not abort on an over-length BLAKE2b digest in a check file#14508Dijaa wants to merge 1 commit into
Dijaa wants to merge 1 commit into
Conversation
When verifying a checksum file, the BLAKE2b output length was inferred from the digest found in the file and handed to the hasher unchecked. A digest longer than the 64 bytes BLAKE2b maximum made blake2b_simd fail its own length assertion and abort the process, instead of the line being reported as malformed. Route that inferred length through parse_blake_length, like the --length and tagged-line paths already do, and treat a rejected length as an improperly formatted line. This matches GNU, which skips such a line and exits 1 with "no properly formatted checksum lines found". HashLength::from_bytes loses its last caller with this change, so drop it. Fixes uutils#14487
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The supplied review found no unresolved approval blockers.
Pull request overview
Fixes checksum validation so over-length BLAKE2b digests are rejected as malformed instead of aborting.
Changes:
- Validate inferred BLAKE2b digest lengths.
- Remove the unused
HashLength::from_byteshelper. - Add regression coverage.
File summaries
| File | Description |
|---|---|
tests/by-util/test_cksum.rs |
Adds oversized BLAKE2b digest coverage. |
src/uucore/src/lib/features/checksum/validate.rs |
Validates inferred digest lengths safely. |
src/uucore/src/lib/features/checksum/mod.rs |
Removes the unused conversion helper. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
GNU testsuite comparison: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A check line whose digest is longer than the 64 bytes BLAKE2b allows takes
down the whole run instead of being skipped:
$ echo data > f1
$ printf '%s f1\n' "$(printf 'ab%.0s' $(seq 65))" > sums # 65-byte digest
$ ./target/release/coreutils b2sum -c sums
thread 'main' panicked at blake2b_simd-1.0.5/src/lib.rs:241:9:
Bad hash length: 65
Aborted (core dumped)
$ echo $?
134
GNU coreutils 9.4 skips the line and says so:
$ b2sum -c sums
b2sum: sums: no properly formatted checksum lines found
$ echo $?
1
cksum -a blake2b --checkgoes down the same path.The
--lengthflag and tagged lines (BLAKE2b-520 (f) = ...) both run theirlength through
parse_blake_length, which rejects anything above 512 bits.The untagged path does not:
process_non_algo_based_linetakes the lengthstraight from the digest it just decoded and hands it on, so
Blake2b::with_output_bytesreachesblake2b_simd'shash_lengthwith 65and trips its assertion.
This sends that inferred length through
parse_blake_lengthtoo, and turns arejected length into
LineCheckError::ImproperlyFormatted— the same "skipthe line" path GNU takes.
HashLength::from_byteshad no caller leftafterwards, so it goes.
Worth noting for anyone reproducing it: the exit code depends on the profile.
In a debug build our own
debug_assert!inBlake2b::with_output_bytesfiresfirst and you get 101; in release it is compiled out,
blake2b_simdaborts,and
panic = "abort"turns that into SIGABRT, 134. Same bug either way.Fixes #14487