Skip to content

Fix an error in how cksum parses checksum files#11553

Draft
frenchua wants to merge 1 commit intouutils:mainfrom
frenchua:fix-cksum-tagged-format-parsing-error
Draft

Fix an error in how cksum parses checksum files#11553
frenchua wants to merge 1 commit intouutils:mainfrom
frenchua:fix-cksum-tagged-format-parsing-error

Conversation

@frenchua
Copy link
Copy Markdown

@frenchua frenchua commented Mar 30, 2026

When cksum (or sha256sum, etc...) is called with the -c option, and it attempts to parse cheksum files in the "tagged output format" and it encounters the string "((", it crashes due to an error in how it parses the checksum file. GNU coreutils, by contrast, correctly recognizes this line as a syntax error and ignores the line.

This is due to the following two lines of code in the parse_algo_based function in validate.rs:

let par_idx = rest.iter().position(|&b| b == b'(')?;
let sub_case = if rest[par_idx - 1] == b' ' {

If the checksum file contains two consecutive left parentheses, then par_idx is equal to zero and so rest[par_idx - 1] evaluates to rest[-1] which causes the program to crash.

I have added a check to make sure that par_idx is greater than zero because, In my view, the string '((' appearing in a checksum file should be considered a syntax error and the line ignored, just as it does in the GNU cksum/sha256sum program).

When cksum (or sha256sum, etc...) attempts to parse chekcusm files in
the "tagged output format" and it encounters the string "((", it
crashes due to an error in how it parses the checksum file. GNU
coreutils, by contrast, correctly recognizes this string as a syntax
error and ignores the line.
@frenchua frenchua marked this pull request as draft March 30, 2026 21:24
@frenchua frenchua marked this pull request as ready for review March 30, 2026 21:26
@github-actions
Copy link
Copy Markdown

GNU testsuite comparison:

Skip an intermittent issue tests/tty/tty-eof (fails in this run but passes in the 'main' branch)

@sylvestre
Copy link
Copy Markdown
Contributor

could you please add a test to make sure we don't regress in the future?
(and that demonstrate the failure you are talking about)
thanks

@frenchua frenchua marked this pull request as draft March 31, 2026 07:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants