118 lines
3.3 KiB
Diff
118 lines
3.3 KiB
Diff
From e311b724eaeeda39b5c23cc23953cbee16103a18 Mon Sep 17 00:00:00 2001
|
|
From: bwzhang <zhangbowei@kylinos.cn>
|
|
Date: Tue, 23 Apr 2024 18:34:28 +0800
|
|
Subject: [PATCH] fix CVE-2024-28180
|
|
|
|
---
|
|
.../github.com/go-jose/go-jose/v3/encoding.go | 21 +++++++++++++++----
|
|
.../gopkg.in/go-jose/go-jose.v2/encoding.go | 21 +++++++++++++++----
|
|
2 files changed, 34 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/vendor/github.com/go-jose/go-jose/v3/encoding.go b/vendor/github.com/go-jose/go-jose/v3/encoding.go
|
|
index 968a424..d083db8 100644
|
|
--- a/vendor/github.com/go-jose/go-jose/v3/encoding.go
|
|
+++ b/vendor/github.com/go-jose/go-jose/v3/encoding.go
|
|
@@ -25,6 +25,7 @@ import (
|
|
"math/big"
|
|
"strings"
|
|
"unicode"
|
|
+ "fmt"
|
|
|
|
"github.com/go-jose/go-jose/v3/json"
|
|
)
|
|
@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
|
|
}
|
|
}
|
|
|
|
-// Compress with DEFLATE
|
|
+// deflate compresses the input.
|
|
func deflate(input []byte) ([]byte, error) {
|
|
output := new(bytes.Buffer)
|
|
|
|
@@ -97,15 +98,27 @@ func deflate(input []byte) ([]byte, error) {
|
|
return output.Bytes(), err
|
|
}
|
|
|
|
-// Decompress with DEFLATE
|
|
+// inflate decompresses the input.
|
|
+//
|
|
+// Errors if the decompressed data would be >250kB or >10x the size of the
|
|
+// compressed data, whichever is larger.
|
|
func inflate(input []byte) ([]byte, error) {
|
|
output := new(bytes.Buffer)
|
|
reader := flate.NewReader(bytes.NewBuffer(input))
|
|
|
|
- _, err := io.Copy(output, reader)
|
|
- if err != nil {
|
|
+ maxCompressedSize := 10 * int64(len(input))
|
|
+ if maxCompressedSize < 250000 {
|
|
+ maxCompressedSize = 250000
|
|
+ }
|
|
+
|
|
+ limit := maxCompressedSize + 1
|
|
+ n, err := io.CopyN(output, reader, limit)
|
|
+ if err != nil && err != io.EOF {
|
|
return nil, err
|
|
}
|
|
+ if n == limit {
|
|
+ return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize)
|
|
+ }
|
|
|
|
err = reader.Close()
|
|
return output.Bytes(), err
|
|
diff --git a/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go b/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go
|
|
index 40b688b..9111733 100644
|
|
--- a/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go
|
|
+++ b/vendor/gopkg.in/go-jose/go-jose.v2/encoding.go
|
|
@@ -25,6 +25,7 @@ import (
|
|
"math/big"
|
|
"strings"
|
|
"unicode"
|
|
+ "fmt"
|
|
|
|
"gopkg.in/go-jose/go-jose.v2/json"
|
|
)
|
|
@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
|
|
}
|
|
}
|
|
|
|
-// Compress with DEFLATE
|
|
+// deflate compresses the input.
|
|
func deflate(input []byte) ([]byte, error) {
|
|
output := new(bytes.Buffer)
|
|
|
|
@@ -97,15 +98,27 @@ func deflate(input []byte) ([]byte, error) {
|
|
return output.Bytes(), err
|
|
}
|
|
|
|
-// Decompress with DEFLATE
|
|
+// inflate decompresses the input.
|
|
+//
|
|
+// Errors if the decompressed data would be >250kB or >10x the size of the
|
|
+// compressed data, whichever is larger.
|
|
func inflate(input []byte) ([]byte, error) {
|
|
output := new(bytes.Buffer)
|
|
reader := flate.NewReader(bytes.NewBuffer(input))
|
|
|
|
- _, err := io.Copy(output, reader)
|
|
- if err != nil {
|
|
+ maxCompressedSize := 10 * int64(len(input))
|
|
+ if maxCompressedSize < 250000 {
|
|
+ maxCompressedSize = 250000
|
|
+ }
|
|
+
|
|
+ limit := maxCompressedSize + 1
|
|
+ n, err := io.CopyN(output, reader, limit)
|
|
+ if err != nil && err != io.EOF {
|
|
return nil, err
|
|
}
|
|
+ if n == limit {
|
|
+ return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize)
|
|
+ }
|
|
|
|
err = reader.Close()
|
|
return output.Bytes(), err
|
|
--
|
|
2.20.1
|
|
|