vendor: update to github.com/vbatts/tar-split@v0.10.2
Update to the latest version of tar-split, which includes a change to fix a memory exhaustion issue where a malformed image could cause the Docker daemon to crash. * tar: asm: store padding in chunks to avoid memory exhaustion Fixes: CVE-2017-14992 Signed-off-by: Aleksa Sarai <asarai@suse.de>
This commit is contained in:
parent
eec662bbee
commit
e0ff7cccc3
|
@ -55,7 +55,7 @@ github.com/miekg/dns 75e6e86cc601825c5dbcd4e0c209eab180997cd7
|
||||||
|
|
||||||
# get graph and distribution packages
|
# get graph and distribution packages
|
||||||
github.com/docker/distribution edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c
|
github.com/docker/distribution edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c
|
||||||
github.com/vbatts/tar-split v0.10.1
|
github.com/vbatts/tar-split v0.10.2
|
||||||
github.com/opencontainers/go-digest a6d0ee40d4207ea02364bd3b9e8e77b9159ba1eb
|
github.com/opencontainers/go-digest a6d0ee40d4207ea02364bd3b9e8e77b9159ba1eb
|
||||||
|
|
||||||
# get go-zfs packages
|
# get go-zfs packages
|
||||||
|
|
|
@ -1,6 +1,7 @@
|
||||||
# tar-split
|
# tar-split
|
||||||
|
|
||||||
[![Build Status](https://travis-ci.org/vbatts/tar-split.svg?branch=master)](https://travis-ci.org/vbatts/tar-split)
|
[![Build Status](https://travis-ci.org/vbatts/tar-split.svg?branch=master)](https://travis-ci.org/vbatts/tar-split)
|
||||||
|
[![Go Report Card](https://goreportcard.com/badge/github.com/vbatts/tar-split)](https://goreportcard.com/report/github.com/vbatts/tar-split)
|
||||||
|
|
||||||
Pristinely disassembling a tar archive, and stashing needed raw bytes and offsets to reassemble a validating original archive.
|
Pristinely disassembling a tar archive, and stashing needed raw bytes and offsets to reassemble a validating original archive.
|
||||||
|
|
||||||
|
@ -50,7 +51,7 @@ For example stored sparse files that have "holes" in them, will be read as a
|
||||||
contiguous file, though the archive contents may be recorded in sparse format.
|
contiguous file, though the archive contents may be recorded in sparse format.
|
||||||
Therefore when adding the file payload to a reassembled tar, to achieve
|
Therefore when adding the file payload to a reassembled tar, to achieve
|
||||||
identical output, the file payload would need be precisely re-sparsified. This
|
identical output, the file payload would need be precisely re-sparsified. This
|
||||||
is not something I seek to fix imediately, but would rather have an alert that
|
is not something I seek to fix immediately, but would rather have an alert that
|
||||||
precise reassembly is not possible.
|
precise reassembly is not possible.
|
||||||
(see more http://www.gnu.org/software/tar/manual/html_node/Sparse-Formats.html)
|
(see more http://www.gnu.org/software/tar/manual/html_node/Sparse-Formats.html)
|
||||||
|
|
||||||
|
|
|
@ -2,7 +2,6 @@ package asm
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"io"
|
"io"
|
||||||
"io/ioutil"
|
|
||||||
|
|
||||||
"github.com/vbatts/tar-split/archive/tar"
|
"github.com/vbatts/tar-split/archive/tar"
|
||||||
"github.com/vbatts/tar-split/tar/storage"
|
"github.com/vbatts/tar-split/tar/storage"
|
||||||
|
@ -119,20 +118,34 @@ func NewInputTarStream(r io.Reader, p storage.Packer, fp storage.FilePutter) (io
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// it is allowable, and not uncommon that there is further padding on the
|
// It is allowable, and not uncommon that there is further padding on
|
||||||
// end of an archive, apart from the expected 1024 null bytes.
|
// the end of an archive, apart from the expected 1024 null bytes. We
|
||||||
remainder, err := ioutil.ReadAll(outputRdr)
|
// do this in chunks rather than in one go to avoid cases where a
|
||||||
if err != nil && err != io.EOF {
|
// maliciously crafted tar file tries to trick us into reading many GBs
|
||||||
pW.CloseWithError(err)
|
// into memory.
|
||||||
return
|
const paddingChunkSize = 1024 * 1024
|
||||||
}
|
var paddingChunk [paddingChunkSize]byte
|
||||||
_, err = p.AddEntry(storage.Entry{
|
for {
|
||||||
Type: storage.SegmentType,
|
var isEOF bool
|
||||||
Payload: remainder,
|
n, err := outputRdr.Read(paddingChunk[:])
|
||||||
})
|
if err != nil {
|
||||||
if err != nil {
|
if err != io.EOF {
|
||||||
pW.CloseWithError(err)
|
pW.CloseWithError(err)
|
||||||
return
|
return
|
||||||
|
}
|
||||||
|
isEOF = true
|
||||||
|
}
|
||||||
|
_, err = p.AddEntry(storage.Entry{
|
||||||
|
Type: storage.SegmentType,
|
||||||
|
Payload: paddingChunk[:n],
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
pW.CloseWithError(err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if isEOF {
|
||||||
|
break
|
||||||
|
}
|
||||||
}
|
}
|
||||||
pW.Close()
|
pW.Close()
|
||||||
}()
|
}()
|
||||||
|
|
Loading…
Reference in New Issue