fix cve-2022-31030

refer to containerd fix: containerd/containerd@2eb6721

Signed-off-by: Rudy Zhang <[email protected]>

Author: rudyfly

.circleci/config.yml

@@ -16,19 +16,6 @@ jobs:
           name: use markdownlint v0.5.0 to lint markdown file (https://github.com/markdownlint/markdownlint)
           command: |
             find  ./ -name  "*.md" | grep -v vendor | grep -v commandline |  grep -v .github |  grep -v swagger |  grep -v api |  xargs mdl -r ~MD010,~MD013,~MD024,~MD029,~MD033,~MD036
-      - run:
-          name: use markdown-link-check(https://github.com/tcort/markdown-link-check) to check links in markdown files
-          command: |
-            set +e
-            for name in $(find . -name \*.md | grep -v vendor | grep -v CHANGELOG); do 
-              if [ -f $name ]; then 
-                markdown-link-check -q $name; 
-                if [ $? -ne 0 ]; then
-                  code=1
-                fi
-              fi 
-            done 
-            bash -c "exit $code";
       - run:
           name: use opensource tool client9/misspell to correct commonly misspelled English words 
           command: |

cri/v1alpha2/cri.go

@@ -71,6 +71,9 @@ const (
 
 	// networkNotReadyReason is the reason reported when network is not ready.
 	networkNotReadyReason = "NetworkPluginNotReady"
+
+	// maxMsgSize is the max size syncExec could output
+	maxMsgSize = 1024 * 1024 * 64
 )
 
 var (
@@ -1213,9 +1216,9 @@ func (c *CriManager) ExecSync(ctx context.Context, r *runtime.ExecSyncRequest) (
 	stdoutBuf, stderrBuf := bytes.NewBuffer(nil), bytes.NewBuffer(nil)
 	attachCfg := &pkgstreams.AttachConfig{
 		UseStdout: true,
-		Stdout:    stdoutBuf,
+		Stdout:    &cappedWriter{stdoutBuf, maxMsgSize},
 		UseStderr: true,
-		Stderr:    stderrBuf,
+		Stderr:    &cappedWriter{stderrBuf, maxMsgSize},
 	}
 
 	if err := c.ContainerMgr.StartExec(ctx, execid, attachCfg, int(r.GetTimeout())); err != nil {

cri/v1alpha2/cri_utils.go

@@ -2,6 +2,7 @@ package v1alpha2
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -1273,3 +1274,31 @@ func applyContainerConfigByAnnotation(annotations map[string]string, config *api
 
 	return nil
 }
+
+type cappedWriter struct {
+	w      io.Writer
+	remain int
+}
+
+var errNoRemain = errors.New("no more space to write")
+
+func (cw *cappedWriter) Write(p []byte) (int, error) {
+	if cw.remain <= 0 {
+		return 0, errNoRemain
+	}
+
+	end := cw.remain
+	if end > len(p) {
+		end = len(p)
+	}
+	written, err := cw.w.Write(p[0:end])
+	cw.remain -= written
+
+	if err != nil {
+		return written, err
+	}
+	if written < len(p) {
+		return written, errNoRemain
+	}
+	return written, nil
+}

cri/v1alpha2/cri_utils_test.go

@@ -1,6 +1,7 @@
 package v1alpha2
 
 import (
+	"bytes"
 	"fmt"
 	"reflect"
 	"strconv"
@@ -1974,3 +1975,20 @@ func Test_applyContainerConfigByAnnotation(t *testing.T) {
 		})
 	}
 }
+
+func TestCWWrite(t *testing.T) {
+	var buf bytes.Buffer
+	cw := &cappedWriter{w: &buf, remain: 10}
+
+	n, err := cw.Write([]byte("hello"))
+	assert.NoError(t, err)
+	assert.Equal(t, 5, n)
+
+	n, err = cw.Write([]byte("helloworld"))
+	assert.Equal(t, []byte("hellohello"), buf.Bytes(), "partial write")
+	assert.Equal(t, 5, n)
+	assert.Equal(t, err.Error(), errNoRemain.Error())
+
+	_, err = cw.Write([]byte("world"))
+	assert.Equal(t, err.Error(), errNoRemain.Error())
+}