* src/cksum.c (split_3): Restrict to length variable digest types.
* tests/cksum/cksum-c.sh: Add test cases.
* NEWS: Mention the fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-ATAXIQDM.
---
NEWS | 7 +++++++
src/cksum.c | 2 ++
tests/cksum/cksum-c.sh | 19 +++++++++++++++++++
3 files changed, 28 insertions(+)
diff --git a/NEWS b/NEWS
index 641117607..c5b5a8e02 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,13 @@ GNU coreutils NEWS -*-
outline -*-
was used, even when the look-up inside the chroot succeeded.
[bug introduced in coreutils-8.23]
+ 'cksum --check' now rejects length suffixes on fixed-length algorithm tags,
+ such as SHA256-8. Previously these caused only part of the digest to be
+ checked, and could cause subsequent full-length untagged checksums to be
+ skipped as improperly formatted, without failing unless --strict was used.
+ This also affects md5sum and sha*sum in single-binary builds.
+ [bug introduced in coreutils-9.0]
+
'cksum --check -a sha2' now verifies all lines in a checksum file that
mixes SHA2 digest lengths. Previously only lines with the same length
as the first tagged line were verified, with other lines being treated
diff --git a/src/cksum.c b/src/cksum.c
index bc454e906..41f146a87 100644
--- a/src/cksum.c
+++ b/src/cksum.c
@@ -985,6 +985,8 @@ split_3 (char *s, idx_t s_len,
&& length != SHA512_DIGEST_SIZE * 8)
return false;
}
+ else if (cksum_algorithm != blake2b)
+ return false; /* Not a length adjustable algorithm. */
# endif
else if (!(0 < length && length <= digest_length && length % 8 == 0))
return false;
diff --git a/tests/cksum/cksum-c.sh b/tests/cksum/cksum-c.sh
index 2271da270..1a1c2a7b4 100755
--- a/tests/cksum/cksum-c.sh
+++ b/tests/cksum/cksum-c.sh
@@ -60,6 +60,25 @@ echo 'cksum: sha2-bad-length.sum: no properly formatted
checksum lines found' \
> experr || framework_failure_
compare experr err || fail=1
+# Ensure a length is only accepted for length adjustable algorithms.
+# coreutils 9.0 - 9.12 inclusive only compared LENGTH bits of the digest,
+# and then ignored any following full length untagged checksums.
+for algo in md5 sha1 sha224 sha256 sha384 sha512 sm3; do
+ cksum -a $algo input | sed 's/ (/-8 (/; s/\( = ..\).*/\1/' > trunc.sum \
+ || framework_failure_
+ for spec in '' "-a $algo"; do
+ returns_ 1 cksum --check $spec trunc.sum 2>err || fail=1
+ echo 'cksum: trunc.sum: no properly formatted checksum lines found' \
+ > experr || framework_failure_
+ compare experr err || fail=1
+ done
+ cksum -a $algo --untagged input >> trunc.sum || framework_failure_
+ cksum --check -a $algo trunc.sum 2>err || fail=1
+ echo 'cksum: WARNING: 1 line is improperly formatted' \
+ > experr || framework_failure_
+ compare experr err || fail=1
+done
+
# Ensure base64 in untagged format that matches tags is supported
# From coreutils 9.2 - 9.8 inclusive this was not supported
echo 'SHA1+++++++++++++++++++++++= /dev/null' > tag-prefix.sum \
--
2.55.0
