cksum: fix incorrectly accepting lengths on fixed length algorithms

* src/cksum.c (split_3): Restrict to length variable digest types.
* tests/cksum/cksum-c.sh: Add test cases.
* NEWS: Mention the fix.

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-ATAXIQDM.

NEWS

@@ -12,6 +12,13 @@ GNU coreutils NEWS                                    -*- outline -*-
   was used, even when the look-up inside the chroot succeeded.
   [bug introduced in coreutils-8.23]
 
+  'cksum --check' now rejects length suffixes on fixed-length algorithm tags,
+  such as SHA256-8.  Previously these caused only part of the digest to be
+  checked, and could cause subsequent full-length untagged checksums to be
+  skipped as improperly formatted, without failing unless --strict was used.
+  This also affects md5sum and sha*sum in single-binary builds.
+  [bug introduced in coreutils-9.0]
+
   'cksum --check -a sha2' now verifies all lines in a checksum file that
   mixes SHA2 digest lengths.  Previously only lines with the same length
   as the first tagged line were verified, with other lines being treated

src/cksum.c

@@ -985,6 +985,8 @@ split_3 (char *s, idx_t s_len,
                   && length != SHA512_DIGEST_SIZE * 8)
                 return false;
             }
+          else if (cksum_algorithm != blake2b)
+            return false;  /* Not a length adjustable algorithm.  */
 # endif
           else if (!(0 < length && length <= digest_length && length % 8 == 0))
             return false;

tests/cksum/cksum-c.sh

@@ -60,6 +60,25 @@ echo 'cksum: sha2-bad-length.sum: no properly formatted checksum lines found' \
   > experr || framework_failure_
 compare experr err || fail=1
 
+# Ensure a length is only accepted for length adjustable algorithms.
+# coreutils 9.0 - 9.12 inclusive only compared LENGTH bits of the digest,
+# and then ignored any following full length untagged checksums.
+for algo in md5 sha1 sha224 sha256 sha384 sha512 sm3; do
+  cksum -a $algo input | sed 's/ (/-8 (/; s/\( = ..\).*/\1/' > trunc.sum \
+    || framework_failure_
+  for spec in '' "-a $algo"; do
+    returns_ 1 cksum --check $spec trunc.sum 2>err || fail=1
+    echo 'cksum: trunc.sum: no properly formatted checksum lines found' \
+      > experr || framework_failure_
+    compare experr err || fail=1
+  done
+  cksum -a $algo --untagged input >> trunc.sum || framework_failure_
+  cksum --check -a $algo trunc.sum 2>err || fail=1
+  echo 'cksum: WARNING: 1 line is improperly formatted' \
+    > experr || framework_failure_
+  compare experr err || fail=1
+done
+
 # Ensure base64 in untagged format that matches tags is supported
 # From coreutils 9.2 - 9.8 inclusive this was not supported
 echo 'SHA1+++++++++++++++++++++++=  /dev/null' > tag-prefix.sum \