From bb422f8e184e4671bda16c0e253fd310b686cfa8 Mon Sep 17 00:00:00 2001 From: Remi Tricot-Le Breton Date: Wed, 26 Aug 2026 17:08:26 +0200 Subject: [PATCH] BUG/MINOR: cache: Seed cache primary hash Since only the first 32bits of the primary hash built in sha1_hosturi are used as key in the cache tree and we reject entries when a hash collision happens, it would be possible for an attacher to fill a specific cache entry with "wrong" data and prevent actual caching. Since a cache seed was already built for secondary key hashes we might as well use it for primary hashes as well. Reported-by: Claude (ANT-2026-9WRFEVJ3) This patch should be backported to all stable branches. --- src/cache.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/cache.c b/src/cache.c index b3009d413..b1a9803d6 100644 --- a/src/cache.c +++ b/src/cache.c @@ -2434,6 +2434,7 @@ int sha1_hosturi(struct stream *s) /* hash everything */ blk_SHA1_Init(&sha1_ctx); + blk_SHA1_Update(&sha1_ctx, &cache_hash_seed, sizeof(cache_hash_seed)); blk_SHA1_Update(&sha1_ctx, trash->area, trash->data); blk_SHA1_Final((unsigned char *)txn->cache_hash, &sha1_ctx); -- 2.47.3