Merge pull request #359 from lluiscampos/3.6.x-MEN-5094-full-read

3.6.x: MEN-5094: Empty the header reader before calculating the checksum
mendersoftware · Sep 23, 2021 · d032968 · d032968
2 parents 4bf817d + cf280f9
commit d032968
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/areader/reader.go b/areader/reader.go
@@ -159,6 +159,10 @@ func (ar *Reader) readHeader(headerSum []byte, comp artifact.Compressor) error {
 		return err
 	}
 
+	// Empty the remaining reader
+	// See (MEN-5094)
+	io.Copy(ioutil.Discard, r)
+
 	// Check if header checksum is correct.
 	if cr, ok := r.(*artifact.Checksum); ok {
 		if err = cr.Verify(); err != nil {
@@ -220,6 +224,10 @@ func (ar *Reader) readAugmentedHeader(headerSum []byte, comp artifact.Compressor
 		return errors.Wrap(err, "readAugmentedHeader")
 	}
 
+	// Empty the remaining reader
+	// See (MEN-5094)
+	io.Copy(ioutil.Discard, r)
+
 	// Check if header checksum is correct.
 	if cr, ok := r.(*artifact.Checksum); ok {
 		if err = cr.Verify(); err != nil {