Fix AddFile to verify actual bytes read matches declared size (closes #25) #30

Merged
sneak merged 1 commits from fix/issue-25 into next 2026-02-09 01:35:07 +01:00

View File

@ -3,6 +3,7 @@ package mfer
import (
"crypto/sha256"
"errors"
"fmt"
"io"
"sync"
"time"
@ -96,6 +97,11 @@ func (b *Builder) AddFile(
}
}
// Verify actual bytes read matches declared size
if totalRead != size {
return totalRead, fmt.Errorf("size mismatch for %q: declared %d bytes but read %d bytes", path, size, totalRead)
}
// Encode hash as multihash (SHA2-256)
mh, err := multihash.Encode(h.Sum(nil), multihash.SHA2_256)
if err != nil {