mirror of
https://github.com/moby/buildkit.git
synced 2026-11-06 05:16:45 +00:00
Sebastiaan van Stijn
90bfd2f47b
The [content.Copy] helper in containerd accepted both `0` and `-1` (or
technically: "any negative value") as sentinel value for content with an
unknown size. While both worked, the function itself only documented
"empty" (`0`) as acccepted values.
Containerd 2.4.2, 2.3.7, 2.2.10, and 2.0.14 applied additional constraints
to prevent a malicious "Size" header from resulting in an unbounded write
(GHSA-hc94-p972-ch66).
As part of the mitigation, the Copy utility now also rejected negative
values ([containerd@91f62bd]) including the (undocumented) `-1` sentinel
value.
While the previous behavior may be restored in a future release of containerd,
let's already remove uses of this undocumented feature in BuildKit.
It's worth noting that the behavior of [content.WriteBlob] also changed due
to the same changes. Behavior of this helper will not be restored, as an
OCI Descriptor with a negative size is not accepted.
[OCI Image Spec v1.1.1] describes it as
> If the length of the retrieved content does not match the specified
> length, the content SHOULD NOT be trusted.
A later commit ([image-spec@02ba6e2]) strengthens this requirement,
adding;
> The size MUST NOT be negative.
[containerd@91f62bd]: https://github.com/containerd/containerd/commit/91f62bdd77e8851fbc6153013b52c25d2badf80e
[content.Copy]: https://github.com/containerd/containerd/blob/v2.4.1/core/content/helpers.go#L184-L191
[content.WriteBlob]: https://github.com/containerd/containerd/blob/v2.4.1/core/content/helpers.go#L126-L133
[image-spec@02ba6e2]: https://github.com/opencontainers/image-spec/commit/02ba6e2143771aaefdb542c2222f40db48ef3a0b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit b143318e6e)