|
| 1 | +From cd21b448e8cdd4a4be1bae172d3dad8dbeafa59b Mon Sep 17 00:00:00 2001 |
| 2 | +From: Kevin Lockwood < [email protected]> |
| 3 | +Date: Wed, 16 Apr 2025 12:57:19 -0700 |
| 4 | +Subject: [PATCH] [Medium] Patch cert-manager for CVE-2025-32386 |
| 5 | + |
| 6 | +Link: https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7 |
| 7 | +--- |
| 8 | + .../helm/v3/pkg/chart/loader/archive.go | 32 ++++++++++++++++++- |
| 9 | + .../helm/v3/pkg/chart/loader/directory.go | 4 +++ |
| 10 | + 2 files changed, 35 insertions(+), 1 deletion(-) |
| 11 | + |
| 12 | +diff --git a/vendor/helm.sh/helm/v3/pkg/chart/loader/archive.go b/vendor/helm.sh/helm/v3/pkg/chart/loader/archive.go |
| 13 | +index 8b38cb8..c42ff31 100644 |
| 14 | +--- a/vendor/helm.sh/helm/v3/pkg/chart/loader/archive.go |
| 15 | ++++ b/vendor/helm.sh/helm/v3/pkg/chart/loader/archive.go |
| 16 | +@@ -33,6 +33,15 @@ import ( |
| 17 | + "helm.sh/helm/v3/pkg/chart" |
| 18 | + ) |
| 19 | + |
| 20 | ++// MaxDecompressedChartSize is the maximum size of a chart archive that will be |
| 21 | ++// decompressed. This is the decompressed size of all the files. |
| 22 | ++// The default value is 100 MiB. |
| 23 | ++var MaxDecompressedChartSize int64 = 100 * 1024 * 1024 // Default 100 MiB |
| 24 | ++ |
| 25 | ++// MaxDecompressedFileSize is the size of the largest file that Helm will attempt to load. |
| 26 | ++// The size of the file is the decompressed version of it when it is stored in an archive. |
| 27 | ++var MaxDecompressedFileSize int64 = 5 * 1024 * 1024 // Default 5 MiB |
| 28 | ++ |
| 29 | + var drivePathPattern = regexp.MustCompile(`^[a-zA-Z]:/`) |
| 30 | + |
| 31 | + // FileLoader loads a chart from a file |
| 32 | +@@ -110,6 +119,7 @@ func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) { |
| 33 | + |
| 34 | + files := []*BufferedFile{} |
| 35 | + tr := tar.NewReader(unzipped) |
| 36 | ++ remainingSize := MaxDecompressedChartSize |
| 37 | + for { |
| 38 | + b := bytes.NewBuffer(nil) |
| 39 | + hd, err := tr.Next() |
| 40 | +@@ -169,10 +179,30 @@ func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) { |
| 41 | + return nil, errors.New("chart yaml not in base directory") |
| 42 | + } |
| 43 | + |
| 44 | +- if _, err := io.Copy(b, tr); err != nil { |
| 45 | ++ if hd.Size > remainingSize { |
| 46 | ++ return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d", MaxDecompressedChartSize) |
| 47 | ++ } |
| 48 | ++ |
| 49 | ++ if hd.Size > MaxDecompressedFileSize { |
| 50 | ++ return nil, fmt.Errorf("decompressed chart file %q is larger than the maximum file size %d", hd.Name, MaxDecompressedFileSize) |
| 51 | ++ } |
| 52 | ++ |
| 53 | ++ limitedReader := io.LimitReader(tr, remainingSize) |
| 54 | ++ |
| 55 | ++ bytesWritten, err := io.Copy(b, limitedReader) |
| 56 | ++ if err != nil { |
| 57 | + return nil, err |
| 58 | + } |
| 59 | + |
| 60 | ++ remainingSize -= bytesWritten |
| 61 | ++ // When the bytesWritten are less than the file size it means the limit reader ended |
| 62 | ++ // copying early. Here we report that error. This is important if the last file extracted |
| 63 | ++ // is the one that goes over the limit. It assumes the Size stored in the tar header |
| 64 | ++ // is correct, something many applications do. |
| 65 | ++ if bytesWritten < hd.Size || remainingSize <= 0 { |
| 66 | ++ return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d", MaxDecompressedChartSize) |
| 67 | ++ } |
| 68 | ++ |
| 69 | + data := bytes.TrimPrefix(b.Bytes(), utf8bom) |
| 70 | + |
| 71 | + files = append(files, &BufferedFile{Name: n, Data: data}) |
| 72 | +diff --git a/vendor/helm.sh/helm/v3/pkg/chart/loader/directory.go b/vendor/helm.sh/helm/v3/pkg/chart/loader/directory.go |
| 73 | +index bbe5438..fe3e67a 100644 |
| 74 | +--- a/vendor/helm.sh/helm/v3/pkg/chart/loader/directory.go |
| 75 | ++++ b/vendor/helm.sh/helm/v3/pkg/chart/loader/directory.go |
| 76 | +@@ -102,6 +102,10 @@ func LoadDir(dir string) (*chart.Chart, error) { |
| 77 | + return fmt.Errorf("cannot load irregular file %s as it has file mode type bits set", name) |
| 78 | + } |
| 79 | + |
| 80 | ++ if fi.Size() > MaxDecompressedFileSize { |
| 81 | ++ return fmt.Errorf("chart file %q is larger than the maximum file size %d", fi.Name(), MaxDecompressedFileSize) |
| 82 | ++ } |
| 83 | ++ |
| 84 | + data, err := ioutil.ReadFile(name) |
| 85 | + if err != nil { |
| 86 | + return errors.Wrapf(err, "error reading %s", n) |
| 87 | +-- |
| 88 | +2.34.1 |
| 89 | + |
0 commit comments