Skip to content

🤖 🐛 Incorrect module hash comparison #425

Description

@asmit25805

🐛 Bug · 🟠 High · Confidence: 98%

File: native/zero-c/src/program_graph_store_binary.c
Location: binary_verify_graph_metadata


What's wrong

The function compares the provided module_hash against store->graph.graph_hash instead of the stored module hash, causing a false failure. The problematic line is: if (!binary_text_eq(module_hash, store->graph.graph_hash)) return binary_diag(diag, path, "repository graph module hash does not match stored graph", store->graph.graph_hash);

Suggested fix

Compare against store->graph.module_hash instead of store->graph.graph_hash. For example:

if (!binary_text_eq(module_hash, store->graph.module_hash))
    return binary_diag(diag, path, "repository graph module hash does not match stored graph", store->graph.module_hash);

About this report

This finding was generated by an automated audit tool using Llama 3.3 70B + verification passes.
Only findings with ≥92% confidence that passed both LLM self-verification and line reference
verification are reported. False positives are still possible — please verify before acting.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions