1 From b0426e63c9ac61657e029f689bcb8dd051e752c6 Mon Sep 17 00:00:00 2001
2 From: Sergey Popovich <popovich_sergei@mail.ua>
3 Date: Fri, 21 Apr 2017 07:32:23 -0700
4 Subject: [PATCH] update: Compare computed vs expected sha256 digit string
7 We produce sha256 digest string using %x snprintf()
8 qualifier for each byte of digest which uses alphabetic
9 characters from "a" to "f" in lower case to represent
10 integer values from 10 to 15.
12 Previously all of the NVD META files supply sha256
13 digest string for corresponding XML file in lower case.
15 However due to some reason this changed recently to
16 provide digest digits in upper case causing fetched
17 data consistency checks to fail. This prevents database
18 from being updated periodically.
20 While commit c4f6e94 (update: Do not treat sha256 failure
21 as fatal if requested) adds useful option to skip
22 digest validation at all and thus provides workaround for
23 this situation, it might be unacceptable for some
24 deployments where we need to ensure that downloaded
25 data is consistent before start parsing it and update
28 Use strcasecmp() to compare two digest strings case
29 insensitively and addressing this case.
31 Upstream-Status: Backport
32 Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua>
35 1 file changed, 1 insertion(+), 1 deletion(-)
37 diff --git a/src/update.c b/src/update.c
38 index 8588f38..3cc6b67 100644
41 @@ -187,7 +187,7 @@ static bool nvdcve_data_ok(const char *meta, const char *data)
42 snprintf(&csum_data[idx], len, "%02hhx", digest[i]);
45 - ret = streq(csum_meta, csum_data);
46 + ret = !strcasecmp(csum_meta, csum_data);
49 munmap(buffer, length);
