From 45d7b1a9e9018a2be5add1dc6d983e6b7b339c61 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Thu, 11 May 2017 13:26:03 +0200 Subject: LocalStore::addToStore(): Check info.narSize It allowed the client to specify bogus narSize values. In particular, Downloader::downloadCached wasn't setting narSize at all. --- src/libstore/download.cc | 1 + 1 file changed, 1 insertion(+) (limited to 'src/libstore/download.cc') diff --git a/src/libstore/download.cc b/src/libstore/download.cc index 4d502219ed..93519ec663 100644 --- a/src/libstore/download.cc +++ b/src/libstore/download.cc @@ -652,6 +652,7 @@ Path Downloader::downloadCached(ref store, const string & url_, bool unpa Hash hash = hashString(expectedHash ? expectedHash.type : htSHA256, *res.data); info.path = store->makeFixedOutputPath(false, hash, name); info.narHash = hashString(htSHA256, *sink.s); + info.narSize = sink.s->size(); info.ca = makeFixedOutputCA(false, hash); store->addToStore(info, sink.s, false, true); storePath = info.path; -- cgit 1.4.1