From ba6e8c8d6912ba3d7f8a147e1b0710e1d1c26344 Mon Sep 17 00:00:00 2001 From: Julien Laurenceau Date: Mon, 12 Oct 2026 17:12:49 +0200 Subject: [PATCH] fix: reset Signature when unmarshaling legacy V1 xl.meta headers The V1 header wire format has no Signature field, so decoding into a reused header leaked the previous object's signature. Reset it along with EcN/EcM so a decode fully replaces the header contents. Signed-off-by: Julien Laurenceau --- cmd/xl-storage-format-v2-legacy.go | 3 +++ cmd/xl-storage-format-v2_test.go | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/cmd/xl-storage-format-v2-legacy.go b/cmd/xl-storage-format-v2-legacy.go index 188b299d3..06201693b 100644 --- a/cmd/xl-storage-format-v2-legacy.go +++ b/cmd/xl-storage-format-v2-legacy.go @@ -40,6 +40,9 @@ func (x *xlMetaV2VersionHeader) unmarshalV(v uint8, bts []byte) (o []byte, err e // unmarshalV1 decodes version 1, never released. func (x *xlMetaV2VersionHeader) unmarshalV1(bts []byte) (o []byte, err error) { + // Fields absent from the V1 wire format must be reset since the + // header may be reused across decodes. + x.Signature = [4]byte{} x.EcN, x.EcM = 0, 0 var zb0001 uint32 zb0001, bts, err = msgp.ReadArrayHeaderBytes(bts) diff --git a/cmd/xl-storage-format-v2_test.go b/cmd/xl-storage-format-v2_test.go index 21e76eb76..0076c8046 100644 --- a/cmd/xl-storage-format-v2_test.go +++ b/cmd/xl-storage-format-v2_test.go @@ -1234,12 +1234,16 @@ func TestXLMetaV2HeaderLegacyUnmarshalResetsEc(t *testing.T) { header = base header.EcN, header.EcM = 4, 8 + header.Signature = [4]byte{9, 9, 9, 9} if _, err := header.unmarshalV1(v1); err != nil { t.Fatalf("legacy V1 header unmarshal failed: %v", err) } if header.EcN != 0 || header.EcM != 0 { t.Fatalf("stale erasure metadata leaked on V1 decode: EcN %d, EcM %d", header.EcN, header.EcM) } + if header.Signature != ([4]byte{}) { + t.Fatalf("stale signature leaked on V1 decode: %v", header.Signature) + } // Current headers must keep their erasure metadata. current := base