Skip to content

cli/context/store: limit decompressed size of TLS files on zip import - #7105

Open
UditDewan wants to merge 1 commit into
docker:masterfrom
UditDewan:fix-context-import-zip-tls-limit
Open

cli/context/store: limit decompressed size of TLS files on zip import#7105
UditDewan wants to merge 1 commit into
docker:masterfrom
UditDewan:fix-context-import-zip-tls-limit

Conversation

@UditDewan

@UditDewan UditDewan commented Jul 12, 2026

Copy link
Copy Markdown

- What I did

Fixed a memory exhaustion issue in docker context import with zip archives (fixes #6917).

The meta.json entry of an imported zip archive is read through limitedReader (10MB cap), but tls/ entries were read with a bare io.ReadAll. Only the compressed archive size was capped, so a small crafted zip containing a highly compressible TLS entry could decompress to gigabytes and OOM the CLI.

- How I did it

Read TLS entries in importZip through the same limitedReader already used for meta.json.

That alone wasn't sufficient: limitedReader had two ways of silently truncating content rather than rejecting it, both of which made the cap ineffective because io.ReadAll treats io.EOF as success.

  • The l.N == 0 branch returned io.EOF once the budget was used up. Reachable whenever a read lands exactly on the remaining budget — deterministic for zip imports, since flate delivers 32KiB chunks that divide the 10MB cap evenly.
  • A reader is permitted to return data together with io.EOF. When such a read crossed the limit, that io.EOF was returned as-is and the limit error was never observed by the caller. (Thanks to the Copilot review for catching this second one.)

The limit error now takes precedence over the underlying error as soon as the budget goes negative. True end-of-data still returns a clean io.EOF from the underlying reader.

- How to verify it

go test ./cli/context/store/

Regression tests:

  • TestImportZipTLSDataTooLarge — imports a zip whose TLS entry inflates past the cap while the archive itself stays well under it, and asserts the import errors.
  • TestLimitReaderReadAll gains two cases: an iotest.OneByteReader that lands a read exactly on the limit with data remaining, and an iotest.DataErrReader that returns data together with io.EOF on the read that crosses the limit. Both assert the limit error is surfaced; both fail against the previous limitedReader.

- Human readable description for the release notes

Left the block below empty because the changelog check requires a matching impact/ label, which I can't set. Suggested note if a maintainer wants this in the release notes:

Fix docker context import allocating unbounded memory for TLS files contained in zip archives

- A picture of a cute animal (not mandatory but encouraged)

🦦

@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens docker context import (zip) against decompression-based memory exhaustion by enforcing size limits on decompressed TLS material and tightening limitedReader behavior.

Changes:

  • Apply limitedReader when reading tls/ zip entries to cap decompressed TLS file size.
  • Adjust limitedReader.Read semantics to avoid silently truncating when reads land exactly on the limit.
  • Add regression tests covering oversized TLS zip entries and a boundary read case for limitedReader.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File Description
cli/context/store/store.go Caps decompressed reads for tls/ zip entries (and highlights loop-close/memory considerations).
cli/context/store/store_test.go Adds a regression test for oversized decompressed TLS zip entries.
cli/context/store/io_utils.go Updates limitedReader.Read to avoid truncation-at-limit behavior.
cli/context/store/io_utils_test.go Extends tests to cover an exact-limit boundary case using iotest.OneByteReader.
Comments suppressed due to low confidence (2)

cli/context/store/store.go:485

  • defer f.Close() inside the zip entry loop can accumulate many deferred closes when importing archives with lots of files, potentially exhausting file descriptors. Close the entry reader immediately after io.ReadAll instead of deferring.
			data, err := io.ReadAll(&limitedReader{R: f, N: maxAllowedFileSizeToImport})
			defer f.Close()
			if err != nil {
				return err
			}

cli/context/store/store.go:487

  • This change caps each TLS entry’s decompressed size, but importZip still accumulates all TLS file contents in memory (tlsData.Endpoints[...].Files[...] = data) with no overall decompressed-size budget. A crafted zip with many highly-compressible TLS entries could still OOM the process even though each individual entry stays under the per-file limit.
			data, err := io.ReadAll(&limitedReader{R: f, N: maxAllowedFileSizeToImport})
			defer f.Close()
			if err != nil {
				return err
			}
			err = importEndpointTLS(&tlsData, zf.Name, data)
			if err != nil {

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +263 to +266
tf, err := w.Create(path.Join("tls", "docker", "ca.pem"))
assert.NilError(t, err)
_, err = tf.Write(make([]byte, 2*maxAllowedFileSizeToImport))
assert.NilError(t, err)

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one compiles as-is, so I have left it unchanged.

make accepts any integer type for the size argument, not just int — the spec only requires that a constant size be representable by a value of type int. maxAllowedFileSizeToImport is a typed int64 constant, and 2 * 10 << 20 = 20 MiB is representable as int on every supported platform (including 32-bit, where int maxes out around 2.1e9).

Confirmed by go vet ./cli/context/store/ locally, and by the test / ctn job passing on this PR — it builds and runs this test file.

Comment on lines 16 to 20
if l.N < 0 {
return 0, errors.New("read exceeds the defined limit")
}
if l.N == 0 {
return 0, io.EOF
}
// have to cap N + 1 otherwise we won't hit limit err
if int64(len(p)) > l.N+1 {

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — this was a real hole, fixed in the latest push.

limitedReader now checks the budget after decrementing and returns the limit error in preference to the underlying error:

n, err = l.R.Read(p)
l.N -= int64(n)
if l.N < 0 {
    return n, errLimitExceeded
}
return n, err

Added a regression test using iotest.DataErrReader, which returns data together with io.EOF on the read that crosses the limit. Against the previous version it fails with expected an error, got nil — i.e. io.ReadAll reported success on truncated content, exactly as described.

Also hoisted the error to a package-level errLimitExceeded sentinel rather than allocating a new one on each Read.

The meta.json entry of an imported zip archive is read through
limitedReader (10MB cap), but tls/ entries were read with a bare
io.ReadAll. Only the compressed archive size was capped, so a small
crafted zip containing a highly compressible TLS entry could decompress
to gigabytes and exhaust memory.

Read TLS entries through the same limitedReader already used for
meta.json.

This also fixes two ways in which limitedReader could silently truncate
content instead of rejecting it, both of which made the cap ineffective
because io.ReadAll treats io.EOF as success:

- the l.N == 0 branch returned io.EOF once the budget was used up. This
  is reachable whenever a read lands exactly on the remaining budget,
  which is deterministic for zip imports since flate delivers 32KiB
  chunks that divide the 10MB cap evenly.
- a reader is permitted to return data together with io.EOF. When such
  a read crossed the limit, that io.EOF was returned as-is and the limit
  error was never observed by the caller.

The limit error now takes precedence over the underlying error as soon
as the budget goes negative. True end-of-data still returns a clean
io.EOF from the underlying reader.

Fixes docker#6917

Signed-off-by: uditDewan <udit.dewan21@gmail.com>
@UditDewan
UditDewan force-pushed the fix-context-import-zip-tls-limit branch from 1b84aa7 to 13f6437 Compare August 2, 2026 21:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

docker context import TLS Entry Handling results in OOM

3 participants