possible trust issue when accepting car files?

[studna]

I'm considering using this library to accept CAR files submitted by end users, who are not necessarily trusted parties. Upon reviewing the code, I noticed that there doesn't appear to be any re-hashing of the data before it's processed.

Could this lack of re-hashing pose a security risk, specifically allowing users to submit a malformed CAR file where the data could be stored under an incorrect CID?