From 9d5f1b3aa40f36b3fcd8f565170cf49602f35765 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=BD=95=E5=86=A0=E5=B3=B0?= <33317070@qq.com>
Date: Tue, 2 Jun 2026 16:09:20 +0800
Subject: [PATCH] fix: verify cache file against manifest FileCRC/FileSize
 instead of self-recorded .info values

---
 .../DefaultCacheFileSystem/DefaultCacheFileSystem.cs          | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Assets/YooAsset/Runtime/FileSystem/DefaultCacheFileSystem/DefaultCacheFileSystem.cs b/Assets/YooAsset/Runtime/FileSystem/DefaultCacheFileSystem/DefaultCacheFileSystem.cs
index 940a7d96..a741b4c7 100644
--- a/Assets/YooAsset/Runtime/FileSystem/DefaultCacheFileSystem/DefaultCacheFileSystem.cs
+++ b/Assets/YooAsset/Runtime/FileSystem/DefaultCacheFileSystem/DefaultCacheFileSystem.cs
@@ -469,7 +469,9 @@ namespace YooAsset
             if (_records.TryGetValue(bundle.BundleGUID, out RecordFileElement element) == false)
                 return EFileVerifyResult.CacheNotFound;
 
-            EFileVerifyResult result = FileVerifyHelper.FileVerify(element.DataFilePath, element.DataFileSize, element.DataFileCRC, EFileVerifyLevel.High);
+            // 注意：使用清单里的权威校验值（与下载/解压时的校验基准一致），而不是缓存记录里来源于本地 .info 文件的自描述值，
+            // 否则数据文件与 .info 文件被一并篡改时仍会校验通过。
+            EFileVerifyResult result = FileVerifyHelper.FileVerify(element.DataFilePath, bundle.FileSize, bundle.FileCRC, EFileVerifyLevel.High);
             return result;
         }
         public bool WriteCacheBundleFile(PackageBundle bundle, string copyPath)