apache / apache/dubbo

[Bug] Bytes.getMD5(InputStream/File) returns incorrect MD5 for short final reads

Open
#16,451 0 comments 0 reactions 0 assignees View on GitHub
component/need-triage type/need-triage
Dominant language
Java
Stars
41.6k
Forks
26.4k
Avg merge
15h 13m
Merged PRs (30d)
4

Description

### Pre-check

- [x] I am sure that all the content I provide is in English.

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/dubbo/issues?q=is%3Aissue) and found no similar issues.

### Apache Dubbo Component

Java SDK (apache/dubbo)

### Dubbo Version

Apache Dubbo 3.3 branch, JDK 8 or later, any operating system.

### Steps to reproduce this issue

`Bytes.getMD5(InputStream)` uses `InputStream.available()` as an EOF check and updates the message digest with the entire buffer instead of the number of bytes actually read.

For example, the bundled `md5.testfile.txt` contains only:

```text
hello world!
```

Calling `Bytes.getMD5(File)` returns the Base64 value:

```text
iNZ+5qHafVNPLJxHwLKJ3w==
```

The correct MD5 of `hello world!` is:

```text
/D/5joxqDTCH1RXARz+Gdw==
```

The same problem occurs for an `InputStream` whose final read is shorter than 8192 bytes.

### What you expected to happen

`Bytes.getMD5(InputStream)` and `Bytes.getMD5(File)` should calculate the MD5 of exactly the bytes supplied by the input source.

### Anything else

The implementation should read until `read()` returns `-1` and update the digest with only the bytes returned by each read:

```java
int read;
while ((read = is.read(buf)) != -1) {
md.update(buf, 0, read);
}
```

A pull request is prepared with tests for 12, 8191, 8192, and 8193 byte inputs, plus an input stream whose `available()` method returns zero while data is still readable.

### Do you have a (mini) reproduction demo?

- [x] Yes, I have a minimal reproduction demo to help resolve this issue more effectively!

### Are you willing to submit a pull request to fix on your own?

- [x] Yes I am willing to submit a pull request on my own!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

Contributor guide

Open the contributing guide

Research direction

Start at Bytes.getMD5(InputStream) and Bytes.getMD5(File), then review the existing MD5 tests and the bundled md5.testfile.txt reproduction. Done means both methods return the MD5 of exactly the supplied bytes, including inputs of 12, 8191, 8192, and 8193 bytes and a stream whose available() returns zero while data remains.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.