From 83e0bdad7a68b9a444dd55bcc23452987724c48c Mon Sep 17 00:00:00 2001
From: Pete Batard <pete@akeo.ie>
Date: Sun, 28 Apr 2024 13:26:38 +0100
Subject: [PATCH] [md5sum] fix unwanted partial matches in is_in_md5sum()

* is_in_md5sum() could partially match a string against another one, which, aside from matching
  unwanted files, could also lead to files not being identified as being in the md5sum.txt if
  the previous partial match happened to be with the current search target.
* Fix this by making sure that we always match a whole path followed by '/n', '/r' or '/0'.
---
 src/iso.c    | 22 ++++++++++++++++------
 src/rufus.rc | 10 +++++-----
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/src/iso.c b/src/iso.c
index 19683980..47733207 100644
--- a/src/iso.c
+++ b/src/iso.c
@@ -493,7 +493,7 @@ static void fix_config(const char* psz_fullpath, const char* psz_path, const cha
 static BOOL is_in_md5sum(char* path)
 {
 	BOOL found = FALSE;
-	char c[3], *p;
+	char c[3], *p, *pos = md5sum_pos, *nul_pos;
 
 	// If we are creating the md5sum file from scratch, every file is in it.
 	if (fd_md5sum != NULL)
@@ -514,14 +514,24 @@ static BOOL is_in_md5sum(char* path)
 
 	// Search for the string in the remainder of the md5sum.txt
 	// NB: md5sum_data is always NUL terminated.
-	p = strstr(md5sum_pos, path);
+	p = strstr(pos, path);
+	// Cater for the case where we matched a partial string and look for the full one
+	while (p != NULL && p[strlen(path)] != '\n' && p[strlen(path)] != '\r' && p[strlen(path)] != '\0') {
+		pos = p + strlen(path);
+		p = strstr(pos, path);
+	}
 	found = (p != NULL);
 	// If not found in remainder and we have a remainder, loop to search from beginning
-	if (!found && md5sum_pos != md5sum_data) {
-		c[2] = *md5sum_pos;
-		*md5sum_pos = 0;
+	if (!found && pos != md5sum_data) {
+		nul_pos = pos;
+		c[2] = *nul_pos;
+		*nul_pos = 0;
 		p = strstr(md5sum_data, path);
-		*md5sum_pos = c[2];
+		while (p != NULL && p[strlen(path)] != '\n' && p[strlen(path)] != '\r' && p[strlen(path)] != '\0') {
+			pos = p + strlen(path);
+			p = strstr(pos, path);
+		}
+		*nul_pos = c[2];
 		found = (p != NULL);
 	}
 
diff --git a/src/rufus.rc b/src/rufus.rc
index a779ac89..4f354c5b 100644
--- a/src/rufus.rc
+++ b/src/rufus.rc
@@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
 IDD_DIALOG DIALOGEX 12, 12, 232, 326
 STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
 EXSTYLE WS_EX_ACCEPTFILES
-CAPTION "Rufus 4.5.2146"
+CAPTION "Rufus 4.5.2147"
 FONT 9, "Segoe UI Symbol", 400, 0, 0x0
 BEGIN
     LTEXT           "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
@@ -397,8 +397,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 4,5,2146,0
- PRODUCTVERSION 4,5,2146,0
+ FILEVERSION 4,5,2147,0
+ PRODUCTVERSION 4,5,2147,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -416,13 +416,13 @@ BEGIN
             VALUE "Comments", "https://rufus.ie"
             VALUE "CompanyName", "Akeo Consulting"
             VALUE "FileDescription", "Rufus"
-            VALUE "FileVersion", "4.5.2146"
+            VALUE "FileVersion", "4.5.2147"
             VALUE "InternalName", "Rufus"
             VALUE "LegalCopyright", "� 2011-2024 Pete Batard (GPL v3)"
             VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
             VALUE "OriginalFilename", "rufus-4.5.exe"
             VALUE "ProductName", "Rufus"
-            VALUE "ProductVersion", "4.5.2146"
+            VALUE "ProductVersion", "4.5.2147"
         END
     END
     BLOCK "VarFileInfo"