Skip to content

Conversation

@rhenium
Copy link
Member

@rhenium rhenium commented Dec 23, 2025

Digest::SHA1#update fails when a very large String is passed in a single call.

Passing 2**29 bytes (512 MB) or more at once does not update the message length counter correctly, which results in producing an incorrect output.

$ ruby -rdigest -e'd=Digest::SHA1.new; d<<"a"*(512*1024*1024); puts d.hexdigest'
40cd9c4b14e7b8d0940a3a92c8a7661fad85a821
$ ruby -rdigest -e'd=Digest::SHA1.new; 512.times{d<<"a"*(1024*1024)}; puts d.hexdigest'
0ea59bfe8787939816796610c73deb1c625e03ed
$ ruby -e'print "a"*(512*1024*1024)'|sha1sum
0ea59bfe8787939816796610c73deb1c625e03ed  -

Passing 2**32 bytes or more causes an infinite loop because the loop counter is too small.

Digest::SHA1#update fails when a very large String is passed in a
single call.

Passing 2**29 bytes (512 MB) or more at once does not update the
message length counter correctly, which results in producing an
incorrect output.

    $ ruby -rdigest -e'd=Digest::SHA1.new; d<<"a"*(512*1024*1024); puts d.hexdigest'
    40cd9c4b14e7b8d0940a3a92c8a7661fad85a821
    $ ruby -rdigest -e'd=Digest::SHA1.new; 512.times{d<<"a"*(1024*1024)}; puts d.hexdigest'
    0ea59bfe8787939816796610c73deb1c625e03ed
    $ ruby -e'print "a"*(512*1024*1024)'|sha1sum
    0ea59bfe8787939816796610c73deb1c625e03ed  -

Passing 2**32 bytes or more causes an infinite loop because the loop
counter is too small.
@rhenium rhenium requested a review from knu as a code owner December 23, 2025 07:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant