mirror of
https://github.com/moby/buildkit.git
synced 2026-11-06 05:16:45 +00:00
Tonis Tiigi
16c6856432
resolveMetadata stored its result into the resolver cache through release(v) where v was a *Metadata. On a failed resolve or a cache hit it set the pointer to nil, but passing a typed nil pointer as an interface stores a non-nil value, so a nil *Metadata was cached for that remote#ref. A later resolve of the same key read it back and dereferenced nil, crashing buildkitd. Because the cache is shared across the jobs on a solve state, an untrusted Dockerfile or frontend could crash the daemon, and one build could poison another's. Store an untyped nil instead, matching the HTTP source, so only a successfully resolved Metadata is ever cached. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com> (cherry picked from commit 4dd98355a71d79bdf93bd3456fda3a64847ce1de) (cherry picked from commit c1399f7266310397f5615f4751147f886afff6d2)