What causes "WARNING: MD5 hash size is wrong. " in DrKLO/Telegram?

Ensure the hash argument is exactly 32 hex characters: trim whitespace, newlines, and any 'MD5' prefix.

WARNING: MD5 hash size is wrong.

Error message

WARNING: MD5 hash size is wrong.

What it means

This is a warning (not a fatal error) printed when the first argument to md5cmp is not exactly 32 characters long. A valid MD5 digest is always 32 hexadecimal characters. The program continues execution after the warning and attempts the comparison anyway, so a mismatch may follow. The strlen check is a sanity guard to alert the user that the provided hash is malformed.

Source

Thrown at TMessagesProj/jni/mozjpeg/md5/md5cmp.c:44

 * POSSIBILITY OF SUCH DAMAGE.
 */

#include <stdio.h>
#include <string.h>
#include "./md5.h"
#include "../tjutil.h"

int main(int argc, char *argv[])
{
  char *md5sum = NULL, buf[65];

  if (argc < 3) {
    fprintf(stderr, "USAGE: %s <correct MD5 sum> <file>\n", argv[0]);
    return -1;
  }

  if (strlen(argv[1]) != 32)
    fprintf(stderr, "WARNING: MD5 hash size is wrong.\n");

  md5sum = MD5File(argv[2], buf);
  if (!md5sum) {
    perror("Could not obtain MD5 sum");
    return -1;
  }

  if (!strcasecmp(md5sum, argv[1])) {
    fprintf(stderr, "%s: OK\n", argv[2]);
    return 0;
  } else {
    fprintf(stderr, "%s: FAILED.  Checksum is %s\n", argv[2], md5sum);
    return -1;
  }
}

View on GitHub (pinned to 45ab8f4308)

Solutions

Ensure the hash argument is exactly 32 hex characters: trim whitespace, newlines, and any 'MD5' prefix.
If the hash comes from md5sum output, extract only the first field: hash=$(md5sum file | cut -d' ' -f1).
Validate the hash length before passing it: reject anything that is not 32 characters of [0-9a-fA-F].

Example fix

# before
md5sum=$(md5sum input.jpg)
md5cmp "$md5sum" input.jpg
# after
md5sum=$(md5sum input.jpg | cut -d' ' -f1)
md5cmp "$md5sum" input.jpg

Defensive patterns

Strategy: validation

Validate before calling

# Validate hash format before passing to md5cmp
hash="$1"
if [ ${#hash} -ne 32 ] || ! echo "$hash" | grep -qE '^[0-9a-fA-F]{32}$'; then
  echo "Error: hash must be 32 hex characters" >&2
  exit 1
fi
md5cmp "$hash" "$2"

Prevention

Strip whitespace and newlines from hash strings before passing them.
Validate that the hash matches ^[0-9a-fA-F]{32}$ before invoking md5cmp.
When using command substitution, pipe through tr -d to remove trailing newlines.

When it happens

Trigger: Passing a hash string that is truncated, has extra whitespace or a newline appended, is base64-encoded instead of hex, or was copied with a prefix like 'md5:' included. The strlen(argv[1]) != 32 check fires on any deviation from exactly 32 characters.

Common situations: Piping the output of md5sum (which includes a filename suffix) without trimming; shell variable containing a trailing newline from command substitution; hash stored in a config file with surrounding quotes or whitespace; base64-encoded digest mistakenly used instead of hex.

Related errors

AI-assisted analysis of DrKLO/Telegram@45ab8f4308 (2026-08-14). Data as JSON: /api/errors/c835d74142cb6333. Report an issue: GitHub.