|
| 1 | +From e58d689dcb58dc14838b8d643b2d6b39d54420be Mon Sep 17 00:00:00 2001 |
| 2 | +From: archana25-ms <v-shettigara@microsoft.com> |
| 3 | +Date: Thu, 17 Apr 2025 10:18:29 +0000 |
| 4 | +Subject: [PATCH] Address CVE-2025-32386 & CVE-2025-32387 |
| 5 | +Upstream Patch Reference: https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7 |
| 6 | +--- |
| 7 | + pkg/chart/loader/archive.go | 32 +++++++++++++++++++++++++++++++- |
| 8 | + pkg/chart/loader/directory.go | 4 ++++ |
| 9 | + 2 files changed, 35 insertions(+), 1 deletion(-) |
| 10 | + |
| 11 | +diff --git a/pkg/chart/loader/archive.go b/pkg/chart/loader/archive.go |
| 12 | +index 196e5f8..4cb994c 100644 |
| 13 | +--- a/pkg/chart/loader/archive.go |
| 14 | ++++ b/pkg/chart/loader/archive.go |
| 15 | +@@ -33,6 +33,15 @@ import ( |
| 16 | + "helm.sh/helm/v3/pkg/chart" |
| 17 | + ) |
| 18 | + |
| 19 | ++// MaxDecompressedChartSize is the maximum size of a chart archive that will be |
| 20 | ++// decompressed. This is the decompressed size of all the files. |
| 21 | ++// The default value is 100 MiB. |
| 22 | ++var MaxDecompressedChartSize int64 = 100 * 1024 * 1024 // Default 100 MiB |
| 23 | ++ |
| 24 | ++// MaxDecompressedFileSize is the size of the largest file that Helm will attempt to load. |
| 25 | ++// The size of the file is the decompressed version of it when it is stored in an archive. |
| 26 | ++var MaxDecompressedFileSize int64 = 5 * 1024 * 1024 // Default 5 MiB |
| 27 | ++ |
| 28 | + var drivePathPattern = regexp.MustCompile(`^[a-zA-Z]:/`) |
| 29 | + |
| 30 | + // FileLoader loads a chart from a file |
| 31 | +@@ -119,6 +128,7 @@ func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) { |
| 32 | + |
| 33 | + files := []*BufferedFile{} |
| 34 | + tr := tar.NewReader(unzipped) |
| 35 | ++ remainingSize := MaxDecompressedChartSize |
| 36 | + for { |
| 37 | + b := bytes.NewBuffer(nil) |
| 38 | + hd, err := tr.Next() |
| 39 | +@@ -178,10 +188,30 @@ func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) { |
| 40 | + return nil, errors.New("chart yaml not in base directory") |
| 41 | + } |
| 42 | + |
| 43 | +- if _, err := io.Copy(b, tr); err != nil { |
| 44 | ++ if hd.Size > remainingSize { |
| 45 | ++ return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d", MaxDecompressedChartSize) |
| 46 | ++ } |
| 47 | ++ |
| 48 | ++ if hd.Size > MaxDecompressedFileSize { |
| 49 | ++ return nil, fmt.Errorf("decompressed chart file %q is larger than the maximum file size %d", hd.Name, MaxDecompressedFileSize) |
| 50 | ++ } |
| 51 | ++ |
| 52 | ++ limitedReader := io.LimitReader(tr, remainingSize) |
| 53 | ++ |
| 54 | ++ bytesWritten, err := io.Copy(b, limitedReader) |
| 55 | ++ if err != nil { |
| 56 | + return nil, err |
| 57 | + } |
| 58 | + |
| 59 | ++ remainingSize -= bytesWritten |
| 60 | ++ // When the bytesWritten are less than the file size it means the limit reader ended |
| 61 | ++ // copying early. Here we report that error. This is important if the last file extracted |
| 62 | ++ // is the one that goes over the limit. It assumes the Size stored in the tar header |
| 63 | ++ // is correct, something many applications do. |
| 64 | ++ if bytesWritten < hd.Size || remainingSize <= 0 { |
| 65 | ++ return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d", MaxDecompressedChartSize) |
| 66 | ++ } |
| 67 | ++ |
| 68 | + data := bytes.TrimPrefix(b.Bytes(), utf8bom) |
| 69 | + |
| 70 | + files = append(files, &BufferedFile{Name: n, Data: data}) |
| 71 | +diff --git a/pkg/chart/loader/directory.go b/pkg/chart/loader/directory.go |
| 72 | +index 9bcbee6..fd8e02e 100644 |
| 73 | +--- a/pkg/chart/loader/directory.go |
| 74 | ++++ b/pkg/chart/loader/directory.go |
| 75 | +@@ -101,6 +101,10 @@ func LoadDir(dir string) (*chart.Chart, error) { |
| 76 | + return fmt.Errorf("cannot load irregular file %s as it has file mode type bits set", name) |
| 77 | + } |
| 78 | + |
| 79 | ++ if fi.Size() > MaxDecompressedFileSize { |
| 80 | ++ return fmt.Errorf("chart file %q is larger than the maximum file size %d", fi.Name(), MaxDecompressedFileSize) |
| 81 | ++ } |
| 82 | ++ |
| 83 | + data, err := os.ReadFile(name) |
| 84 | + if err != nil { |
| 85 | + return errors.Wrapf(err, "error reading %s", n) |
| 86 | +-- |
| 87 | +2.45.3 |
| 88 | + |
0 commit comments