Compute checksum when reading packfiles

1 files changed, 18 insertions, 0 deletions

diff --git a/pack_midx.go b/pack_midx.go
index 748bdaf6..04151dfe 100644
--- a/pack_midx.go
+++ b/pack_midx.go
@@ -1,6 +1,7 @@
 package furgit
 
 import (
+	"bytes"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -235,6 +236,23 @@ func (midx *multiPackIndex) parse(buf []byte) error {
 	midx.oids = oids
 	midx.offsets = offsets
 	midx.largeOffs = largeOffs
+
+	if len(buf) < midx.repo.hashSize {
+		return ErrInvalidObject
+	}
+	midxChecksumStart := len(buf) - midx.repo.hashSize
+	midxChecksumInFile := buf[midxChecksumStart:]
+
+	hashFn, ok := hashFuncs[midx.repo.hashSize]
+	if !ok {
+		return fmt.Errorf("furgit: unsupported hash size %d", midx.repo.hashSize)
+	}
+
+	computedHash := hashFn(buf[:midxChecksumStart])
+	if !bytes.Equal(computedHash.data[:midx.repo.hashSize], midxChecksumInFile) {
+		return fmt.Errorf("furgit: multi-pack-index checksum mismatch")
+	}
+
 	return nil
 }