pull: Validate layer digest format
Otherwise a malformed or empty digest may cause a panic.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit a7d4af84bd2f189b921c3ec60796aa825e3a0f2a)
Signed-off-by: Tibor Vass <tibor@docker.com>
diff --git a/builder/builder-next/adapters/containerimage/pull.go b/builder/builder-next/adapters/containerimage/pull.go
index 729ef52..9d6e07e 100644
--- a/builder/builder-next/adapters/containerimage/pull.go
+++ b/builder/builder-next/adapters/containerimage/pull.go
@@ -526,6 +526,9 @@
layers := make([]xfer.DownloadDescriptor, 0, len(mfst.Layers))
for i, desc := range mfst.Layers {
+ if err := desc.Digest.Validate(); err != nil {
+ return nil, errors.Wrap(err, "layer digest could not be validated")
+ }
ongoing.add(desc)
layers = append(layers, &layerDescriptor{
desc: desc,
diff --git a/distribution/pull_v2.go b/distribution/pull_v2.go
index 3307458..cb47264 100644
--- a/distribution/pull_v2.go
+++ b/distribution/pull_v2.go
@@ -477,6 +477,9 @@
// to top-most, so that the downloads slice gets ordered correctly.
for i := len(verifiedManifest.FSLayers) - 1; i >= 0; i-- {
blobSum := verifiedManifest.FSLayers[i].BlobSum
+ if err = blobSum.Validate(); err != nil {
+ return "", "", errors.Wrapf(err, "could not validate layer digest %q", blobSum)
+ }
var throwAway struct {
ThrowAway bool `json:"throwaway,omitempty"`
@@ -575,6 +578,9 @@
// Note that the order of this loop is in the direction of bottom-most
// to top-most, so that the downloads slice gets ordered correctly.
for _, d := range layers {
+ if err := d.Digest.Validate(); err != nil {
+ return "", errors.Wrapf(err, "could not validate layer digest %q", d.Digest)
+ }
layerDescriptor := &v2LayerDescriptor{
digest: d.Digest,
repo: p.repo,
