PVer4: Verify checksum for downloaded updates

components/safe_browsing_db/v4_store_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "base/test/test_simple_task_runner.h"
 #include "base/time/time.h"
 #include "components/safe_browsing_db/v4_store.h"
 #include "components/safe_browsing_db/v4_store.pb.h"
 #include "content/public/test/test_browser_thread_bundle.h"
+#include "crypto/sha2.h"
 #include "testing/platform_test.h"
 
 namespace safe_browsing {
 
 using ::google::protobuf::RepeatedField;
 using ::google::protobuf::RepeatedPtrField;
 using ::google::protobuf::int32;
 
 class V4StoreTest : public PlatformTest {
  public:
@@ skipping 90 matching lines @@
 
 TEST_F(V4StoreTest, TestReadFromNoHashPrefixInfoFile) {
   WriteFileFormatProtoToFile(0x600D71FE, 9);
   EXPECT_EQ(HASH_PREFIX_INFO_MISSING_FAILURE,
             V4Store(task_runner_, store_path_).ReadFromDisk());
 }
 
 TEST_F(V4StoreTest, TestReadFromNoHashPrefixesFile) {
   ListUpdateResponse list_update_response;
   list_update_response.set_platform_type(LINUX_PLATFORM);
+  list_update_response.set_response_type(ListUpdateResponse::FULL_UPDATE);
   WriteFileFormatProtoToFile(0x600D71FE, 9, &list_update_response);
   EXPECT_EQ(READ_SUCCESS, V4Store(task_runner_, store_path_).ReadFromDisk());
 }
 
 TEST_F(V4StoreTest, TestWriteNoResponseType) {
   EXPECT_EQ(INVALID_RESPONSE_TYPE_FAILURE,
             V4Store(task_runner_, store_path_)
                 .WriteToDisk(base::WrapUnique(new ListUpdateResponse)));
 }
 
@@ skipping 87 matching lines @@
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "54321abcde", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(
       APPLY_UPDATE_SUCCESS,
       V4Store::AddUnlumpedHashes(4, "----1111bbbb", &prefix_map_additions));
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "22222bcdef", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
+  // Proof of checksum validity using python:
+  // >>> import hashlib
+  // >>> m = hashlib.sha256()
+  // >>> m.update("----11112222254321abcdabcdebbbbbcdefefgh")
+  // >>> m.digest()
+  // "\xbc\xb3\xedk\xe3x\xd1(\xa9\xedz7]"
+  // "x\x18\xbdn]\xa5\xa8R\xf7\xab\xcf\xc1\xa3\xa3\xc5Z,\xa6o"
+  std::string expected_checksum = std::string(
+      "\xBC\xB3\xEDk\xE3x\xD1(\xA9\xEDz7]x\x18\xBDn]"
+      "\xA5\xA8R\xF7\xAB\xCF\xC1\xA3\xA3\xC5Z,\xA6o",
+      crypto::kSHA256Length);
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
-            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr));
+            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr,
+                              expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   EXPECT_EQ(2u, prefix_map.size());
 
   PrefixSize prefix_size = 4;
   HashPrefixes hash_prefixes = prefix_map.at(prefix_size);
   EXPECT_EQ(5 * prefix_size, hash_prefixes.size());
   EXPECT_EQ("----", hash_prefixes.substr(0 * prefix_size, prefix_size));
   EXPECT_EQ("1111", hash_prefixes.substr(1 * prefix_size, prefix_size));
   EXPECT_EQ("abcd", hash_prefixes.substr(2 * prefix_size, prefix_size));
   EXPECT_EQ("bbbb", hash_prefixes.substr(3 * prefix_size, prefix_size));
@@ skipping 10 matching lines @@
 
 TEST_F(V4StoreTest, TestMergeUpdatesWithDifferentSizesInEachMap) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "1111abcdefgh", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "22222bcdef", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
+  std::string expected_checksum = std::string(
+      "\xA5\x8B\xCAsD\xC7\xF9\xCE\xD2\xF4\x4="
+      "\xB2\"\x82\x1A\xC1\xB8\x1F\x10\r\v\x9A\x93\xFD\xE1\xB8"
+      "B\x1Eh\xF7\xB4",
+      crypto::kSHA256Length);
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
-            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr));
+            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr,
+                              expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   EXPECT_EQ(2u, prefix_map.size());
 
   PrefixSize prefix_size = 4;
   HashPrefixes hash_prefixes = prefix_map.at(prefix_size);
   EXPECT_EQ(3 * prefix_size, hash_prefixes.size());
   EXPECT_EQ("1111abcdefgh", hash_prefixes);
 
   prefix_size = 5;
   hash_prefixes = prefix_map.at(prefix_size);
   EXPECT_EQ(2 * prefix_size, hash_prefixes.size());
   EXPECT_EQ("22222bcdef", hash_prefixes);
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesOldMapRunsOutFirst) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "00001111", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "2222", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
+  std::string expected_checksum = std::string(
+      "\x84\x92\xET\xED\xF7\x97"
+      "C\xCE}\xFF"
+      "E\x1\xAB-\b>\xDB\x95\b\xD8H\xD5\x1D\xF9]8x\xA4\xD4\xC2\xFA",
+      crypto::kSHA256Length);
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
-            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr));
+            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr,
+                              expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   EXPECT_EQ(1u, prefix_map.size());
 
   PrefixSize prefix_size = 4;
   HashPrefixes hash_prefixes = prefix_map.at(prefix_size);
   EXPECT_EQ(3 * prefix_size, hash_prefixes.size());
   EXPECT_EQ("0000", hash_prefixes.substr(0 * prefix_size, prefix_size));
   EXPECT_EQ("1111", hash_prefixes.substr(1 * prefix_size, prefix_size));
   EXPECT_EQ("2222", hash_prefixes.substr(2 * prefix_size, prefix_size));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesAdditionsMapRunsOutFirst) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "2222", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "00001111", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
+  std::string expected_checksum = std::string(
+      "\x84\x92\xET\xED\xF7\x97"
+      "C\xCE}\xFF"
+      "E\x1\xAB-\b>\xDB\x95\b\xD8H\xD5\x1D\xF9]8x\xA4\xD4\xC2\xFA",
+      crypto::kSHA256Length);
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
-            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr));
+            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr,
+                              expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   EXPECT_EQ(1u, prefix_map.size());
 
   PrefixSize prefix_size = 4;
   HashPrefixes hash_prefixes = prefix_map.at(prefix_size);
   EXPECT_EQ(3 * prefix_size, hash_prefixes.size());
   EXPECT_EQ("0000", hash_prefixes.substr(0 * prefix_size, prefix_size));
   EXPECT_EQ("1111", hash_prefixes.substr(1 * prefix_size, prefix_size));
   EXPECT_EQ("2222", hash_prefixes.substr(2 * prefix_size, prefix_size));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesFailsForRepeatedHashPrefix) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "2222", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "2222", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
+  std::string expected_checksum;
   EXPECT_EQ(ADDITIONS_HAS_EXISTING_PREFIX_FAILURE,
-            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr));
+            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr,
+                              expected_checksum));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesFailsWhenRemovalsIndexTooLarge) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "2222", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "11113333", &prefix_map_additions));
 
   // Even though the merged map could have size 3 without removals, the
   // removals index should only count the entries in the old map.
   V4Store store(task_runner_, store_path_);
   RepeatedField<int32> raw_removals;
   // old_store: ["2222"]
   raw_removals.Add(1);
-  EXPECT_EQ(
-      REMOVALS_INDEX_TOO_LARGE_FAILURE,
-      store.MergeUpdate(prefix_map_old, prefix_map_additions, &raw_removals));
+  std::string expected_checksum;
+  EXPECT_EQ(REMOVALS_INDEX_TOO_LARGE_FAILURE,
+            store.MergeUpdate(prefix_map_old, prefix_map_additions,
+                              &raw_removals, expected_checksum));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesRemovesOnlyElement) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "2222", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "1111133333", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
   RepeatedField<int32> raw_removals;
   // old_store: ["2222"]
   raw_removals.Add(0);  // Removes "2222"
-  EXPECT_EQ(
-      APPLY_UPDATE_SUCCESS,
-      store.MergeUpdate(prefix_map_old, prefix_map_additions, &raw_removals));
+  std::string expected_checksum = std::string(
+      "\xE6\xB0\x1\x12\x89\x83\xF0/"
+      "\xE7\xD2\xE6\xDC\x16\xB9\x8C+\xA2\xB3\x9E\x89<,\x88"
+      "B3\xA5\xB1"
+      "D\x9E\x9E'\x14",
+      crypto::kSHA256Length);
+  EXPECT_EQ(APPLY_UPDATE_SUCCESS,
+            store.MergeUpdate(prefix_map_old, prefix_map_additions,
+                              &raw_removals, expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   // The size is 2 since we reserve space anyway.
   EXPECT_EQ(2u, prefix_map.size());
   EXPECT_TRUE(prefix_map.at(4).empty());
   EXPECT_EQ("1111133333", prefix_map.at(5));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesRemovesFirstElement) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "22224444", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "1111133333", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
   RepeatedField<int32> raw_removals;
   // old_store: ["2222", "4444"]
   raw_removals.Add(0);  // Removes "2222"
-  EXPECT_EQ(
-      APPLY_UPDATE_SUCCESS,
-      store.MergeUpdate(prefix_map_old, prefix_map_additions, &raw_removals));
+  std::string expected_checksum = std::string(
+      "\x9D\xF3\xF2\x82\0\x1E{\xDF\xCD\xC0V\xBE\xD6<\x85"
+      "D7=\xB5v\xAD\b1\xC9\xB3"
+      "A\xAC"
+      "b\xF1lf\xA4",
+      crypto::kSHA256Length);
+  EXPECT_EQ(APPLY_UPDATE_SUCCESS,
+            store.MergeUpdate(prefix_map_old, prefix_map_additions,
+                              &raw_removals, expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   // The size is 2 since we reserve space anyway.
   EXPECT_EQ(2u, prefix_map.size());
   EXPECT_EQ("4444", prefix_map.at(4));
   EXPECT_EQ("1111133333", prefix_map.at(5));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesRemovesMiddleElement) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "222233334444", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "1111133333", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
   RepeatedField<int32> raw_removals;
   // old_store: ["2222", "3333", 4444"]
   raw_removals.Add(1);  // Removes "3333"
-  EXPECT_EQ(
-      APPLY_UPDATE_SUCCESS,
-      store.MergeUpdate(prefix_map_old, prefix_map_additions, &raw_removals));
+  std::string expected_checksum = std::string(
+      "\xFA-A\x15{\x17\0>\xAE"
+      "8\xACigR\xD1\x93<\xB2\xC9\xB5\x81\xC0\xFB\xBB\x2\f\xAFpN\xEA"
+      "44",
+      crypto::kSHA256Length);
+  EXPECT_EQ(APPLY_UPDATE_SUCCESS,
+            store.MergeUpdate(prefix_map_old, prefix_map_additions,
+                              &raw_removals, expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   // The size is 2 since we reserve space anyway.
   EXPECT_EQ(2u, prefix_map.size());
   EXPECT_EQ("22224444", prefix_map.at(4));
   EXPECT_EQ("1111133333", prefix_map.at(5));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesRemovesLastElement) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "222233334444", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "1111133333", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
   RepeatedField<int32> raw_removals;
   // old_store: ["2222", "3333", 4444"]
   raw_removals.Add(2);  // Removes "4444"
-  EXPECT_EQ(
-      APPLY_UPDATE_SUCCESS,
-      store.MergeUpdate(prefix_map_old, prefix_map_additions, &raw_removals));
+  std::string expected_checksum = std::string(
+      "a\xE1\xAD\x96\xFE\xA6"
+      "A\xCA~7W\xF6z\xD8\n\xCA?\x96\x8A\x17U\x5\v\r\x88]\n\xB2JX\xC4S",
+      crypto::kSHA256Length);
+  EXPECT_EQ(APPLY_UPDATE_SUCCESS,
+            store.MergeUpdate(prefix_map_old, prefix_map_additions,
+                              &raw_removals, expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   // The size is 2 since we reserve space anyway.
   EXPECT_EQ(2u, prefix_map.size());
   EXPECT_EQ("22223333", prefix_map.at(4));
   EXPECT_EQ("1111133333", prefix_map.at(5));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesRemovesWhenOldHasDifferentSizes) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "222233334444", &prefix_map_old));
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "aaaaabbbbb", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "1111133333", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
   RepeatedField<int32> raw_removals;
   // old_store: ["2222", "3333", 4444", "aaaaa", "bbbbb"]
   raw_removals.Add(3);  // Removes "aaaaa"
-  EXPECT_EQ(
-      APPLY_UPDATE_SUCCESS,
-      store.MergeUpdate(prefix_map_old, prefix_map_additions, &raw_removals));
+  std::string expected_checksum = std::string(
+      "\xA7OG\x9D\x83.\x9D-f\x8A\xE\x8B\r&\x19"
+      "6\xE3\xF0\xEFTi\xA7\x5\xEA\xF7"
+      "ej,\xA8\x9D\xAD\x91",
+      crypto::kSHA256Length);
+  EXPECT_EQ(APPLY_UPDATE_SUCCESS,
+            store.MergeUpdate(prefix_map_old, prefix_map_additions,
+                              &raw_removals, expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   // The size is 2 since we reserve space anyway.
   EXPECT_EQ(2u, prefix_map.size());
   EXPECT_EQ("222233334444", prefix_map.at(4));
   EXPECT_EQ("1111133333bbbbb", prefix_map.at(5));
 }
 
 TEST_F(V4StoreTest, TestMergeUpdatesRemovesMultipleAcrossDifferentSizes) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "22223333aaaa", &prefix_map_old));
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "3333344444bbbbb", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "11111", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
   RepeatedField<int32> raw_removals;
   // old_store: ["2222", "3333", "33333", "44444", "aaaa", "bbbbb"]
   raw_removals.Add(1);  // Removes "3333"
   raw_removals.Add(3);  // Removes "44444"
-  EXPECT_EQ(
-      APPLY_UPDATE_SUCCESS,
-      store.MergeUpdate(prefix_map_old, prefix_map_additions, &raw_removals));
+  std::string expected_checksum = std::string(
+      "!D\xB7&L\xA7&G0\x85\xB4"
+      "E\xDD\x10\"\x9A\xCA\xF1"
+      "3^\x83w\xBBL\x19n\xAD\xBDM\x9D"
+      "b\x9F",
+      crypto::kSHA256Length);
+  EXPECT_EQ(APPLY_UPDATE_SUCCESS,
+            store.MergeUpdate(prefix_map_old, prefix_map_additions,
+                              &raw_removals, expected_checksum));
+
   const HashPrefixMap& prefix_map = store.hash_prefix_map_;
   // The size is 2 since we reserve space anyway.
   EXPECT_EQ(2u, prefix_map.size());
   EXPECT_EQ("2222aaaa", prefix_map.at(4));
   EXPECT_EQ("1111133333bbbbb", prefix_map.at(5));
 }
 
 TEST_F(V4StoreTest, TestReadFullResponseWithValidHashPrefixMap) {
   std::unique_ptr<ListUpdateResponse> lur(new ListUpdateResponse);
   lur->set_response_type(ListUpdateResponse::FULL_UPDATE);
@@ skipping 164 matching lines @@
 
 TEST_F(V4StoreTest, TestRemovalsWithRiceEncodingSucceeds) {
   HashPrefixMap prefix_map_old;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(4, "1111abcdefgh", &prefix_map_old));
   HashPrefixMap prefix_map_additions;
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
             V4Store::AddUnlumpedHashes(5, "22222bcdef", &prefix_map_additions));
 
   V4Store store(task_runner_, store_path_);
+  std::string expected_checksum = std::string(
+      "\xA5\x8B\xCAsD\xC7\xF9\xCE\xD2\xF4\x4="
+      "\xB2\"\x82\x1A\xC1\xB8\x1F\x10\r\v\x9A\x93\xFD\xE1\xB8"
+      "B\x1Eh\xF7\xB4",
+      crypto::kSHA256Length);
   EXPECT_EQ(APPLY_UPDATE_SUCCESS,
-            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr));
+            store.MergeUpdate(prefix_map_old, prefix_map_additions, nullptr,
+                              expected_checksum));
 
   // At this point, the store map looks like this:
   // 4: 1111abcdefgh
   // 5: 22222bcdef
   // sorted: 1111, 22222, abcd, bcdef, efgh
   // We'll now try to delete hashes at indexes 0, 3 and 4 in the sorted list.
 
   std::unique_ptr<ListUpdateResponse> lur(new ListUpdateResponse);
   lur->set_response_type(ListUpdateResponse::PARTIAL_UPDATE);
   ThreatEntrySet* removal = lur->add_removals();
   removal->set_compression_type(RICE);
   RiceDeltaEncoding* rice_indices = removal->mutable_rice_indices();
   rice_indices->set_first_value(0);
   rice_indices->set_num_entries(2);
   rice_indices->set_rice_parameter(2);
   rice_indices->set_encoded_data("\x16");
 
   bool called_back = false;
   UpdatedStoreReadyCallback store_ready_callback =
       base::Bind(&V4StoreTest::UpdatedStoreReadyAfterRiceRemovals,
                  base::Unretained(this), &called_back);
   store.ApplyUpdate(std::move(lur), task_runner_, store_ready_callback);
   task_runner_->RunPendingTasks();
   base::RunLoop().RunUntilIdle();
 
   // This ensures that the callback was called.
   EXPECT_TRUE(called_back);
 }
 
+TEST_F(V4StoreTest, TestMergeUpdatesFailsChecksum) {
+  // Proof of checksum mismatch using python:
+  // >>> import hashlib
+  // >>> m = hashlib.sha256()
+  // >>> m.update("2222")
+  // >>> m.digest()
+  // "\xed\xee)\xf8\x82T;\x95f
+  // \xb2m\x0e\xe0\xe7\xe9P9\x9b\x1cB"\xf5\xde\x05\xe0d%\xb4\xc9\x95\xe9"
+
+  HashPrefixMap prefix_map_old;
+  EXPECT_EQ(APPLY_UPDATE_SUCCESS,
+            V4Store::AddUnlumpedHashes(4, "2222", &prefix_map_old));
+  EXPECT_EQ(CHECKSUM_MISMATCH_FAILURE,
+            V4Store(task_runner_, store_path_)
+                .MergeUpdate(prefix_map_old, HashPrefixMap(), nullptr, "aawc"));
+}
+
 }  // namespace safe_browsing