kotovalexarian-likes-github
/
moby--moby
mirror of https://github.com/moby/moby.git
1
0
Fork 0
Code Releases Activity

pull: Validate layer digest format 

Otherwise a malformed or empty digest may cause a panic.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit a7d4af84bd)
Signed-off-by: Tibor Vass <tibor@docker.com>
This commit is contained in:
Brian Goff 2020-10-12 18:08:28 +00:00 committed by Tibor Vass
parent 5472f39022
commit 420b1d3625
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
builder/builder-next/adapters/containerimage/pull.go
View File

@ -526,6 +526,9 @@ func (p *puller) Snapshot(ctx context.Context) (cache.ImmutableRef, error) {
layers := make([]xfer.DownloadDescriptor, 0, len(mfst.Layers)) layers := make([]xfer.DownloadDescriptor, 0, len(mfst.Layers))
for i, desc := range mfst.Layers { for i, desc := range mfst.Layers {
if err := desc.Digest.Validate(); err != nil {
return nil, errors.Wrap(err, "layer digest could not be validated")
}
ongoing.add(desc) ongoing.add(desc)
layers = append(layers, &layerDescriptor{ layers = append(layers, &layerDescriptor{
desc: desc, desc: desc,

6
distribution/pull_v2.go
View File

@ -477,6 +477,9 @@ func (p *v2Puller) pullSchema1(ctx context.Context, ref reference.Reference, unv
// to top-most, so that the downloads slice gets ordered correctly. // to top-most, so that the downloads slice gets ordered correctly.
for i := len(verifiedManifest.FSLayers) - 1; i >= 0; i-- { for i := len(verifiedManifest.FSLayers) - 1; i >= 0; i-- {
blobSum := verifiedManifest.FSLayers[i].BlobSum blobSum := verifiedManifest.FSLayers[i].BlobSum
if err = blobSum.Validate(); err != nil {
return "", "", errors.Wrapf(err, "could not validate layer digest %q", blobSum)
}
var throwAway struct { var throwAway struct {
ThrowAway bool `json:"throwaway,omitempty"` ThrowAway bool `json:"throwaway,omitempty"`
@ -575,6 +578,9 @@ func (p *v2Puller) pullSchema2Layers(ctx context.Context, target distribution.De
// Note that the order of this loop is in the direction of bottom-most // Note that the order of this loop is in the direction of bottom-most
// to top-most, so that the downloads slice gets ordered correctly. // to top-most, so that the downloads slice gets ordered correctly.
for _, d := range layers { for _, d := range layers {
if err := d.Digest.Validate(); err != nil {
return "", errors.Wrapf(err, "could not validate layer digest %q", d.Digest)
}
layerDescriptor := &v2LayerDescriptor{ layerDescriptor := &v2LayerDescriptor{
digest: d.Digest, digest: d.Digest,
repo: p.repo, repo: p.repo,