Hacker News Reader

"The bug has been introduced with commit https://git.openwrt.org/54cc7e3 which failed to advance the proper string pointer when skipping the leading white- space portition of the checksum string, causing the subsequent hex decoding loop to return early with a zero length checksum."

I can't believe someone messed up something so simple! ( Sarcasm )

There HAS to be a better way lmao

View on HN

Yeah, yuck, this definitely could have been avoided if they did some proper lexing/parsing before dealing with the line, instead of manually separating things apart after matching on the beginning of the string...

That said, perhaps it's just too early in the morning but I don't think that commit introduced the error. The math/logic looks to be identical and I think the bug is `line + strlen("SHA256sum") + 1` which was already there before and doesn't increment past any spaces which might come after the (implied I guess?) colon. Though considering the colon isn't checked for in `SHA256sum`, you could put any character there and it'll work. Yay...

Nice catch I think. I’ll be damned if I can see a difference. Looks like the old code will also skip the checksum in the case of any non hexdigit padding.

If one is of the tinfoil hat persuasion, then

https://en.wikipedia.org/wiki/Underhanded_C_Contest

Reply on news.ycombinator.com