fix cve-2022-31030

refer to containerd fix: containerd/containerd@2eb6721 Signed-off-by: Rudy Zhang <[email protected]>
gaopeiyang · Sep 20, 2022 · fd8d661 · fd8d661
1 parent 932d068
commit fd8d661
Show file tree

Hide file tree

Showing 4 changed files with 52 additions and 15 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -16,19  16,6 @@ jobs:
           name: use markdownlint v0.5.0 to lint markdown file (https://github.com/markdownlint/markdownlint)
           command: |
             find  ./ -name  "*.md" | grep -v vendor | grep -v commandline |  grep -v .github |  grep -v swagger |  grep -v api |  xargs mdl -r ~MD010,~MD013,~MD024,~MD029,~MD033,~MD036
-      - run:
-          name: use markdown-link-check(https://github.com/tcort/markdown-link-check) to check links in markdown files
-          command: |
-            set  e
-            for name in $(find . -name \*.md | grep -v vendor | grep -v CHANGELOG); do 
-              if [ -f $name ]; then 
-                markdown-link-check -q $name; 
-                if [ $? -ne 0 ]; then
-                  code=1
-                fi
-              fi 
-            done 
-            bash -c "exit $code";
       - run:
           name: use opensource tool client9/misspell to correct commonly misspelled English words 
           command: |

diff --git a/cri/v1alpha2/cri.go b/cri/v1alpha2/cri.go
@@ -71,6  71,9 @@ const (
 
 	// networkNotReadyReason is the reason reported when network is not ready.
 	networkNotReadyReason = "NetworkPluginNotReady"
 
 	// maxMsgSize is the max size syncExec could output
 	maxMsgSize = 1024 * 1024 * 64
 )
 
 var (
@@ -1213,9  1216,9 @@ func (c *CriManager) ExecSync(ctx context.Context, r *runtime.ExecSyncRequest) (
 	stdoutBuf, stderrBuf := bytes.NewBuffer(nil), bytes.NewBuffer(nil)
 	attachCfg := &pkgstreams.AttachConfig{
 		UseStdout: true,
-		Stdout:    stdoutBuf,
 		Stdout:    &cappedWriter{stdoutBuf, maxMsgSize},
 		UseStderr: true,
-		Stderr:    stderrBuf,
 		Stderr:    &cappedWriter{stderrBuf, maxMsgSize},
 	}
 
 	if err := c.ContainerMgr.StartExec(ctx, execid, attachCfg, int(r.GetTimeout())); err != nil {

diff --git a/cri/v1alpha2/cri_utils.go b/cri/v1alpha2/cri_utils.go
@@ -2,6  2,7 @@ package v1alpha2
 
 import (
 	"bytes"
 	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -1273,3  1274,31 @@ func applyContainerConfigByAnnotation(annotations map[string]string, config *api
 
 	return nil
 }
 
 type cappedWriter struct {
 	w      io.Writer
 	remain int
 }
 
 var errNoRemain = errors.New("no more space to write")
 
 func (cw *cappedWriter) Write(p []byte) (int, error) {
 	if cw.remain <= 0 {
 		return 0, errNoRemain
 	}
 
 	end := cw.remain
 	if end > len(p) {
 		end = len(p)
 	}
 	written, err := cw.w.Write(p[0:end])
 	cw.remain -= written
 
 	if err != nil {
 		return written, err
 	}
 	if written < len(p) {
 		return written, errNoRemain
 	}
 	return written, nil
 }
diff --git a/cri/v1alpha2/cri_utils_test.go b/cri/v1alpha2/cri_utils_test.go
@@ -1,6  1,7 @@
 package v1alpha2
 
 import (
 	"bytes"
 	"fmt"
 	"reflect"
 	"strconv"
@@ -1974,3  1975,20 @@ func Test_applyContainerConfigByAnnotation(t *testing.T) {
 		})
 	}
 }
 
 func TestCWWrite(t *testing.T) {
 	var buf bytes.Buffer
 	cw := &cappedWriter{w: &buf, remain: 10}
 
 	n, err := cw.Write([]byte("hello"))
 	assert.NoError(t, err)
 	assert.Equal(t, 5, n)
 
 	n, err = cw.Write([]byte("helloworld"))
 	assert.Equal(t, []byte("hellohello"), buf.Bytes(), "partial write")
 	assert.Equal(t, 5, n)
 	assert.Equal(t, err.Error(), errNoRemain.Error())
 
 	_, err = cw.Write([]byte("world"))
 	assert.Equal(t, err.Error(), errNoRemain.Error())
 }