AU: Verify that the applied delta update matches the server-sent hashes.

download_action.cc

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "update_engine/download_action.h"
 #include <errno.h>
 #include <algorithm>
 #include <string>
 #include <vector>
 #include <glib.h>
@@ skipping 129 matching lines @@
   ActionExitCode code =
       successful ? kActionCodeSuccess : kActionCodeDownloadTransferError;
   if (code == kActionCodeSuccess) {
     if (!install_plan_.is_full_update) {
       if (!delta_performer_->VerifyPayload("",
                                            install_plan_.download_hash,
                                            install_plan_.size)) {
         LOG(ERROR) << "Download of " << install_plan_.download_url
                    << " failed due to payload verification error.";
         code = kActionCodeDownloadPayloadVerificationError;
+      } else if (!delta_performer_->VerifyAppliedUpdate(
+          install_plan_.install_path, install_plan_.kernel_install_path)) {
+        LOG(ERROR) << "Download of " << install_plan_.download_url
+                   << " failed due to applied update verification error.";
+        code = kActionCodeDownloadAppliedUpdateVerificationError;
       }
     } else {
       // Makes sure the hash and size are correct for an old-style full update.
       omaha_hash_calculator_.Finalize();
       if (omaha_hash_calculator_.hash() != install_plan_.download_hash) {
         LOG(ERROR) << "Download of " << install_plan_.download_url
                    << " failed. Expected hash " << install_plan_.download_hash
                    << " but got hash " << omaha_hash_calculator_.hash();
         code = kActionCodeDownloadHashMismatchError;
       } else if (bytes_received_ != install_plan_.size) {
         LOG(ERROR) << "Download of " << install_plan_.download_url
                    << " failed. Expected size " << install_plan_.size
                    << " but got size " << bytes_received_;
         code = kActionCodeDownloadSizeMismatchError;
       }
     }
   }
 
   FlushLinuxCaches();
 
   // Write the path to the output pipe if we're successful.
   if (code == kActionCodeSuccess && HasOutputPipe())
     SetOutputObject(GetInputObject());
   processor_->ActionComplete(this, code);
 }
 
 };  // namespace {}