Skip to content

Fix panics caused by unregistered algorithm #923

Description

@Wwwsylvia

We need to scan the oras-go code base to identify and fix any instances where an unregistered algorithm could cause a panic.

I just found an instance:

oras-go/content/reader.go

Lines 100 to 111 in d92df9d

// NewVerifyReader wraps r for reading content with verification against desc.
func NewVerifyReader(r io.Reader, desc ocispec.Descriptor) *VerifyReader {
verifier := desc.Digest.Verifier()
lr := &io.LimitedReader{
R: io.TeeReader(r, verifier),
N: desc.Size,
}
return &VerifyReader{
base: lr,
verifier: verifier,
}
}

In this function, if the algorithm used in the digest is unregistered, line 102 will panic.

I also tested OCIStore.Fetch(), Repository.Fetch(), and Repository.FetchReference(). I observed that if there is an unsupported digest type is returned in the "Docker-Content-Digest" header, oras-go will return an error instead of panicking.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions