From 1fe0a4bfad5d7fa418f4e726211f4f037e59cfee Mon Sep 17 00:00:00 2001
From: zhangyu235 <zhangyu235@huawei.com>
Date: Tue, 8 Jan 2019 19:47:28 +0800
Subject: [PATCH 051/111] docker:  fix panic when load maliciously
 image

reason:fix oom panic when load maliciously modified image with
huge size manifest files

cherry-pick from docker 1.11.2:
- bbe29c3 fix panic when load maliciously image

Change-Id: I2525e492fac31c33d3ba7275c95b570322a05025
Signed-off-by: leizhongkai <leizhongkai@huawei.com>
Signed-off-by: zhangyu235 <zhangyu235@huawei.com>
---
 components/engine/image/tarexport/load.go     | 28 +++++++++++++++++++
 .../engine/image/tarexport/tarexport.go       |  1 +
 2 files changed, 29 insertions(+)

diff --git a/components/engine/image/tarexport/load.go b/components/engine/image/tarexport/load.go
index 786214383e..b9f8f7e3ac 100644
--- a/components/engine/image/tarexport/load.go
+++ b/components/engine/image/tarexport/load.go
@@ -49,6 +49,11 @@ func (l *tarexporter) Load(inTar io.ReadCloser, outStream io.Writer, quiet bool)
 	if err != nil {
 		return err
 	}
+
+	if err = checkJsonFileSize(manifestPath); err != nil {
+		return err
+	}
+
 	manifestFile, err := os.Open(manifestPath)
 	if err != nil {
 		if os.IsNotExist(err) {
@@ -72,6 +77,9 @@ func (l *tarexporter) Load(inTar io.ReadCloser, outStream io.Writer, quiet bool)
 		if err != nil {
 			return err
 		}
+		if err = checkJsonFileSize(configPath); err != nil {
+			return err
+		}
 		config, err := ioutil.ReadFile(configPath)
 		if err != nil {
 			return err
@@ -246,6 +254,11 @@ func (l *tarexporter) legacyLoad(tmpDir string, outStream io.Writer, progressOut
 	if err != nil {
 		return err
 	}
+
+	if err = checkJsonFileSize(repositoriesPath); err != nil {
+		return err
+	}
+
 	repositoriesFile, err := os.Open(repositoriesPath)
 	if err != nil {
 		return err
@@ -286,6 +299,9 @@ func (l *tarexporter) legacyLoadImage(oldID, sourceDir string, loadedMap map[str
 	if err != nil {
 		return err
 	}
+	if err = checkJsonFileSize(configPath); err != nil {
+		return err
+	}
 	imageJSON, err := ioutil.ReadFile(configPath)
 	if err != nil {
 		logrus.Debugf("Error reading json: %v", err)
@@ -413,6 +429,18 @@ func checkValidParent(img, parent *image.Image) bool {
 	return true
 }
 
+func checkJsonFileSize(path string) error {
+	fileInfo, err := os.Stat(path)
+	if err != nil {
+		return err
+	}
+	fileSize := fileInfo.Size()
+	if fileSize > maxJsonFileSize {
+		return fmt.Errorf("%s is too large", filepath.Base(path))
+	}
+	return nil
+}
+
 func checkCompatibleOS(imageOS string) error {
 	// always compatible if the images OS matches the host OS; also match an empty image OS
 	if imageOS == runtime.GOOS || imageOS == "" {
diff --git a/components/engine/image/tarexport/tarexport.go b/components/engine/image/tarexport/tarexport.go
index beff668cd8..f23fe6f8bb 100644
--- a/components/engine/image/tarexport/tarexport.go
+++ b/components/engine/image/tarexport/tarexport.go
@@ -13,6 +13,7 @@ const (
 	legacyConfigFileName       = "json"
 	legacyVersionFileName      = "VERSION"
 	legacyRepositoriesFileName = "repositories"
+	maxJsonFileSize            = (10 * 1024 * 1024)
 )
 
 type manifestItem struct {
-- 
2.17.1