Skip to content
Permalink
Browse files Browse the repository at this point in the history
Merge pull request from GHSA-259w-8hf6-59c2
[release/1.6] importer: stream oci-layout and manifest.json
  • Loading branch information
dmcgowan committed Feb 15, 2023
2 parents 9cec7a8 + 84936fd commit 0c31490
Showing 1 changed file with 7 additions and 5 deletions.
12 changes: 7 additions & 5 deletions images/archive/importer.go
Expand Up @@ -232,12 +232,14 @@ func ImportIndex(ctx context.Context, store content.Store, reader io.Reader, opt
return writeManifest(ctx, store, idx, ocispec.MediaTypeImageIndex)
}

const (
kib = 1024
mib = 1024 * kib
jsonLimit = 20 * mib
)

func onUntarJSON(r io.Reader, j interface{}) error {
b, err := io.ReadAll(r)
if err != nil {
return err
}
return json.Unmarshal(b, j)
return json.NewDecoder(io.LimitReader(r, jsonLimit)).Decode(j)
}

func onUntarBlob(ctx context.Context, r io.Reader, store content.Ingester, size int64, ref string) (digest.Digest, error) {
Expand Down

0 comments on commit 0c31490

Please sign in to comment.