libopkg: fix md5sum calculation

This regression prevents MD5 checksums from being checked. Packages are
still installed, but this raises several issues:

- if only MD5 checksums are provided in the package list, it is trivial
  for an attacker to modify the content of a package, since checksum
  verification is bypassed. If both MD5 and SHA256 checksums are
  provided, then SHA256 is correctly verified and the attack is not
  possible.

- future efforts to harden checksum verification would prevent package
  installation.

Note that OpenWrt has switched to SHA256 for all its packages several
years ago. As a result, this bug does not affect OpenWrt packages from the
official package feeds.

However, custom package repositories that only use MD5 are affected.

Initially submitted at https://github.com/openwrt/openwrt/pull/3087

Fixes: 33f7b80aa325 ("libopkg: drop custom md5 implementation,
unconditionally enable sha256 support")

Signed-off-by: Alexander Ryzhov <github@ryzhov-al.ru>
[Add commit description]
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>

diff --git a/libopkg/file_util.c b/libopkg/file_util.c
index 3a1761eea76d331e15d8327bfb20ca8f86e52d92..8e698cc58006703dd84b5b79499683090db8a833 100644 (file)
--- a/libopkg/file_util.c
+++ b/libopkg/file_util.c
@@ -153,7 +153,7 @@ char *file_md5sum_alloc(const char *file_name)
 
        len = md5sum(file_name, md5sum_bin);
 
-       if (len) {
+       if (len < 0) {
                opkg_msg(ERROR, "Could't compute md5sum for %s.\n", file_name);
                return NULL;
        }