Prevent panic in Docker pusher.

ctalledo · k8s-infra-cherrypick-robot · commit 8a638b71aef4 · 2025-04-14T21:25:41.000Z
Prevent a panic in the Docker pusher pushWriter, by checking that the pipe is non nil before attempting to use it. The panic was found by Moby issue #46746 (moby/moby#46746). With this fix the panic no longer reproduces. Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
diff --git a/core/remotes/docker/pusher.go b/core/remotes/docker/pusher.go
@@ -477,13 +477,15 @@ func (pw *pushWriter) Digest() digest.Digest {
 
 func (pw *pushWriter) Commit(ctx context.Context, size int64, expected digest.Digest, opts ...content.Opt) error {
 	// Check whether read has already thrown an error
-	if _, err := pw.pipe.Write([]byte{}); err != nil && !errors.Is(err, io.ErrClosedPipe) {
-		return fmt.Errorf("pipe error before commit: %w", err)
+	if pw.pipe != nil {
+		if _, err := pw.pipe.Write([]byte{}); err != nil && !errors.Is(err, io.ErrClosedPipe) {
+			return fmt.Errorf("pipe error before commit: %w", err)
+		}
+		if err := pw.pipe.Close(); err != nil {
+			return err
+		}
 	}
 
-	if err := pw.pipe.Close(); err != nil {
-		return err
-	}
 	// TODO: timeout waiting for response
 	var resp *http.Response
 	select {
