Make BigInteger calculations more secure: BigInteger ordered composition is not guaranteed to be collision-free when the inputs are not uniformly distributed. Thus, we cannot blindly add strings/booleans/etc. when fingerprinting. For simplicity, we delegate to a normal Fingerprint for everything that isn't known to be uniformly distributed, although we then have to be careful with how BigInteger is ordered with respect to the other fields.
PiperOrigin-RevId: 232551309
diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/TreeArtifactValue.java b/src/main/java/com/google/devtools/build/lib/skyframe/TreeArtifactValue.java
index 9221ebc..dd72ee2 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/TreeArtifactValue.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/TreeArtifactValue.java
@@ -108,7 +108,7 @@
public BigInteger getValueFingerprint() {
if (valueFingerprint == null) {
BigIntegerFingerprint fp = new BigIntegerFingerprint();
- fp.addBytes(digest);
+ fp.addDigestedBytes(digest);
valueFingerprint = fp.getFingerprint();
}
return valueFingerprint;
