From 53f00ce02aa1c44306229783461b7dcd2e6206f5 Mon Sep 17 00:00:00 2001 From: Jakob Borg Date: Fri, 6 May 2016 16:09:15 +0200 Subject: [PATCH] lib/upgrade: Don't attempt processing files larger than expected max binary size (ref #3045) --- lib/upgrade/upgrade_supported.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/upgrade/upgrade_supported.go b/lib/upgrade/upgrade_supported.go index 4631a059e..1c948cdce 100644 --- a/lib/upgrade/upgrade_supported.go +++ b/lib/upgrade/upgrade_supported.go @@ -224,6 +224,11 @@ func readTarGz(archiveName, dir string, r io.Reader) (string, error) { if err != nil { return "", err } + if hdr.Size > maxBinarySize { + // We don't even want to try processing or skipping over files + // that are too large. + break + } err = archiveFileVisitor(dir, &tempName, &sig, hdr.Name, tr) if err != nil { @@ -264,6 +269,12 @@ func readZip(archiveName, dir string, r io.Reader) (string, error) { } i++ + if file.UncompressedSize64 > maxBinarySize { + // We don't even want to try processing or skipping over files + // that are too large. + break + } + inFile, err := file.Open() if err != nil { return "", err