importer: stream oci-layout and manifest.json

samuelkarp · samuelkarp · commit 84936fd1f6a0 · 2023-02-07T18:53:30.000-08:00
Signed-off-by: Samuel Karp <samuelkarp@google.com> (cherry picked from commit 9e4acc0) Signed-off-by: Samuel Karp <samuelkarp@google.com>
diff --git a/images/archive/importer.go b/images/archive/importer.go
@@ -232,12 +232,14 @@ func ImportIndex(ctx context.Context, store content.Store, reader io.Reader, opt
 	return writeManifest(ctx, store, idx, ocispec.MediaTypeImageIndex)
 }
 
+const (
+	kib       = 1024
+	mib       = 1024 * kib
+	jsonLimit = 20 * mib
+)
+
 func onUntarJSON(r io.Reader, j interface{}) error {
-	b, err := io.ReadAll(r)
-	if err != nil {
-		return err
-	}
-	return json.Unmarshal(b, j)
+	return json.NewDecoder(io.LimitReader(r, jsonLimit)).Decode(j)
 }
 
 func onUntarBlob(ctx context.Context, r io.Reader, store content.Ingester, size int64, ref string) (digest.Digest, error) {
