mirror of
https://github.com/moby/buildkit.git
synced 2026-11-06 05:16:45 +00:00
Sebastiaan van Stijn
b143318e6e
The [content.Copy] helper in containerd accepted both `0` and `-1` (or technically: "any negative value") as sentinel value for content with an unknown size. While both worked, the function itself only documented "empty" (`0`) as acccepted values. Containerd 2.4.2, 2.3.7, 2.2.10, and 2.0.14 applied additional constraints to prevent a malicious "Size" header from resulting in an unbounded write (GHSA-hc94-p972-ch66). As part of the mitigation, the Copy utility now also rejected negative values ([containerd@91f62bd]) including the (undocumented) `-1` sentinel value. While the previous behavior may be restored in a future release of containerd, let's already remove uses of this undocumented feature in BuildKit. It's worth noting that the behavior of [content.WriteBlob] also changed due to the same changes. Behavior of this helper will not be restored, as an OCI Descriptor with a negative size is not accepted. [OCI Image Spec v1.1.1] describes it as > If the length of the retrieved content does not match the specified > length, the content SHOULD NOT be trusted. A later commit ([image-spec@02ba6e2]) strengthens this requirement, adding; > The size MUST NOT be negative. [containerd@91f62bd]: https://github.com/containerd/containerd/commit/91f62bdd77e8851fbc6153013b52c25d2badf80e [content.Copy]: https://github.com/containerd/containerd/blob/v2.4.1/core/content/helpers.go#L184-L191 [content.WriteBlob]: https://github.com/containerd/containerd/blob/v2.4.1/core/content/helpers.go#L126-L133 [image-spec@02ba6e2]: https://github.com/opencontainers/image-spec/commit/02ba6e2143771aaefdb542c2222f40db48ef3a0b Signed-off-by: Sebastiaan van Stijn <github@gone.nl>