From d299b0c1ed6b20ee9538394a43689384c59a2599 Mon Sep 17 00:00:00 2001
From: liuxianwei <liuxianwei@etsnet.cn>
Date: Sat, 6 Sep 2025 15:26:15 +0800
Subject: [PATCH] =?UTF-8?q?bugfix:=20=E8=A7=A3=E5=86=B3=E5=8A=A0=E5=AF=86?=
 =?UTF-8?q?=E5=8E=8B=E7=BC=A9=E6=96=87=E4=BB=B6=E5=A4=AA=E5=A4=A7=E7=9A=84?=
 =?UTF-8?q?oom=20=E9=97=AE=E9=A2=98=EF=BC=8C=E5=8E=9F=E5=9B=A0=E6=98=AF?=
 =?UTF-8?q?=E8=AE=A1=E7=AE=97hash=E5=80=BC=E7=9A=84=E6=97=B6=E5=80=99?=
 =?UTF-8?q?=E4=BC=9A=E5=B0=86=E5=85=A8=E9=83=A8=E6=95=B0=E6=8D=AE=E8=AF=BB?=
 =?UTF-8?q?=E5=88=B0=E5=86=85=E5=AD=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crypto.go | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/crypto.go b/crypto.go
index 137b674..f1d28f1 100644
--- a/crypto.go
+++ b/crypto.go
@@ -145,10 +145,11 @@ func xorBytes(dst, a, b []byte) int {
 // recommended if: 1. you buffer the data yourself and wait for authentication
 // before streaming to another source such as the network, or 2. you just don't
 // care about authenticating unknown ciphertext before use :).
-func newAuthReader(akey []byte, data, adata io.Reader, streaming bool) io.Reader {
+func newAuthReader(akey []byte, data, rdata, adata io.Reader, streaming bool) io.Reader {
 	ar := authReader{
 		data:  data,
 		adata: adata,
+		rdata: rdata,
 		mac:   hmac.New(sha1.New, akey),
 		err:   nil,
 		auth:  false,
@@ -158,13 +159,13 @@ func newAuthReader(akey []byte, data, adata io.Reader, streaming bool) io.Reader
 	}
 	return &bufferedAuthReader{
 		ar,
-		new(bytes.Buffer),
 	}
 }
 
 // Streaming authentication
 type authReader struct {
 	data  io.Reader // data to be authenticated
+	rdata io.Reader // data to be return
 	adata io.Reader // the authentication code to read
 	mac   hash.Hash // hmac hash
 	err   error
@@ -210,7 +211,6 @@ func (a *authReader) Read(p []byte) (int, error) {
 // buffered authentication
 type bufferedAuthReader struct {
 	authReader
-	buf *bytes.Buffer // buffer to store data to authenticate
 }
 
 func (a *bufferedAuthReader) Read(b []byte) (int, error) {
@@ -220,7 +220,7 @@ func (a *bufferedAuthReader) Read(b []byte) (int, error) {
 	}
 	// make sure we have auth'ed before we send any data
 	if !a.auth {
-		_, err := io.Copy(a.buf, a.data)
+		_, err := io.Copy(a.mac, a.data)
 		if err != nil {
 			a.err = err
 			return 0, a.err
@@ -234,18 +234,13 @@ func (a *bufferedAuthReader) Read(b []byte) (int, error) {
 			a.err = ErrDecryption
 			return 0, a.err
 		}
-		_, err = a.mac.Write(a.buf.Bytes())
-		if err != nil {
-			a.err = err
-			return 0, a.err
-		}
 		if !a.checkAuthentication(ab.Bytes()) {
 			a.err = ErrAuthentication
 			return 0, a.err
 		}
 	}
 	// so we've authenticated the data, now just pass it on.
-	n, err := a.buf.Read(b)
+	n, err := a.rdata.Read(b)
 	if err != nil {
 		a.err = err
 	}
@@ -303,9 +298,10 @@ func newDecryptionReader(r *io.SectionReader, f *File) (io.Reader, error) {
 	// f.CompressedSize64 = uint64(dataLen)
 	// f.CompressedSize = uint32(dataLen)
 	data := io.NewSectionReader(r, dataOff, dataLen)
+	rdata := io.NewSectionReader(r, dataOff, dataLen)
 	authOff := dataOff + dataLen
 	authcode := io.NewSectionReader(r, authOff, 10)
-	ar := newAuthReader(authKey, data, authcode, f.DeferAuth)
+	ar := newAuthReader(authKey, data, rdata, authcode, f.DeferAuth)
 	dr := decryptStream(decKey, ar)
 	if dr == nil {
 		return nil, ErrDecryption