fix(security): cap decompressed output to stop image/archive decompression bombs (#142)

A malicious image layer or build-context archive that compresses tiny but
expands to hundreds of GB could fill the HOST disk during pull/build (DoS) —
extraction streamed gzip/zstd/bzip2/xz into tar with no bound on decompressed
output. The sibling ADD-URL path already caps downloads at MAX_ADD_URL_BYTES
(512 MiB); the local-archive and layer paths had no equivalent.

- New `oci::limited_reader::LimitedReader`: a Read adapter that errors once a
  byte budget is exceeded, plus `cap_from_env` for operator-tunable ceilings.
- extract_layer (registry pull): wrap the decoder, cap total decompressed bytes
  (A3S_BOX_MAX_LAYER_BYTES, default 16 GiB). Refactored into a cap-parameterized
  inner fn so the bomb path is testable without env races. Also surface the
  underlying cause in the error (tar's Display alone hides the cap abort).
- extract_tar_to_dst (build ADD/COPY auto-extract): wrap every decoder branch
  (tar/tar.gz/tar.bz2/tar.xz) with the cap (A3S_BOX_MAX_BUILD_EXTRACT_BYTES,
  default 4 GiB) — restoring parity with the already-capped ADD-URL path.

Defaults are generous (no realistic legit single layer/archive hits them) and
env-tunable; a bomb (100s of GB–PB) is bounded and aborts with a clear error.

Tests: LimitedReader unit tests (errors past cap / passes under); extract_layer
bomb test asserts a 64 KiB member under a 4 KiB cap ABORTS and bounds bytes
written; generous-cap test confirms no regression. Neuter-verified on the KVM
server (dropping the wrap makes the bomb test FAIL: got Ok). fmt + clippy clean.

Severity: HIGH for build ADD (build farms / hosted build APIs run untrusted
Dockerfiles), MEDIUM for layer pull (malicious-image precondition).

Co-authored-by: Roy Lin <roylin@a3s.box>

Author: ZhiXiao-Lin

src/runtime/src/oci/build/engine/utils.rs

@@ -22,6 +22,7 @@ pub(super) fn is_tar_archive(name: &str) -> bool {
 
 /// Extract a tar archive to a destination directory.
 pub(super) fn extract_tar_to_dst(archive_path: &Path, dst: &Path) -> Result<()> {
+    use crate::oci::limited_reader::LimitedReader;
     use flate2::read::GzDecoder;
     use std::io::BufReader;
 
@@ -43,8 +44,17 @@ pub(super) fn extract_tar_to_dst(archive_path: &Path, dst: &Path) -> Result<()>
 
     let name = archive_path.to_str().unwrap_or("").to_lowercase();
 
+    // Bound decompressed output so a compression-bomb archive (`ADD app.tar.gz`)
+    // cannot fill the build host's disk. Mirrors the MAX_ADD_URL_BYTES cap on the
+    // ADD-URL path (which the local-archive path previously lacked); tune with
+    // A3S_BOX_MAX_BUILD_EXTRACT_BYTES.
+    let max_bytes = crate::oci::limited_reader::cap_from_env(
+        "A3S_BOX_MAX_BUILD_EXTRACT_BYTES",
+        4 * 1024 * 1024 * 1024,
+    );
+
     if name.ends_with(".tar.gz") || name.ends_with(".tgz") {
-        let decoder = GzDecoder::new(BufReader::new(file));
+        let decoder = LimitedReader::new(GzDecoder::new(BufReader::new(file)), max_bytes);
         let mut archive = tar::Archive::new(decoder);
         archive.unpack(dst).map_err(|e| {
             BoxError::BuildError(format!(
@@ -64,7 +74,7 @@ pub(super) fn extract_tar_to_dst(archive_path: &Path, dst: &Path) -> Result<()>
         {
             use bzip2::read::BzDecoder;
 
-            let decoder = BzDecoder::new(BufReader::new(file));
+            let decoder = LimitedReader::new(BzDecoder::new(BufReader::new(file)), max_bytes);
             let mut archive = tar::Archive::new(decoder);
             archive.unpack(dst).map_err(|e| {
                 BoxError::BuildError(format!(
@@ -85,7 +95,7 @@ pub(super) fn extract_tar_to_dst(archive_path: &Path, dst: &Path) -> Result<()>
         {
             use xz2::read::XzDecoder;
 
-            let decoder = XzDecoder::new(BufReader::new(file));
+            let decoder = LimitedReader::new(XzDecoder::new(BufReader::new(file)), max_bytes);
             let mut archive = tar::Archive::new(decoder);
             archive.unpack(dst).map_err(|e| {
                 BoxError::BuildError(format!(
@@ -96,7 +106,7 @@ pub(super) fn extract_tar_to_dst(archive_path: &Path, dst: &Path) -> Result<()>
             })?;
         }
     } else if name.ends_with(".tar") {
-        let mut archive = tar::Archive::new(BufReader::new(file));
+        let mut archive = tar::Archive::new(LimitedReader::new(BufReader::new(file), max_bytes));
         archive.unpack(dst).map_err(|e| {
             BoxError::BuildError(format!(
                 "Failed to extract tar {}: {}",

src/runtime/src/oci/layers.rs

@@ -24,6 +24,19 @@ use tar::Archive;
 /// - Extraction fails
 /// - Target directory cannot be created
 pub fn extract_layer(layer_path: &Path, target_dir: &Path) -> Result<()> {
+    // Bound total decompressed output so a compression-bomb layer (a few MB that
+    // expands to hundreds of GB of zeros) cannot fill the host disk during pull.
+    // Generous default; tune with A3S_BOX_MAX_LAYER_BYTES.
+    let max_layer_bytes =
+        super::limited_reader::cap_from_env("A3S_BOX_MAX_LAYER_BYTES", 16 * 1024 * 1024 * 1024);
+    extract_layer_with_cap(layer_path, target_dir, max_layer_bytes)
+}
+
+fn extract_layer_with_cap(
+    layer_path: &Path,
+    target_dir: &Path,
+    max_layer_bytes: u64,
+) -> Result<()> {
     // Validate layer exists
     if !layer_path.exists() {
         return Err(BoxError::OciImageError(format!(
@@ -82,6 +95,8 @@ pub fn extract_layer(layer_path: &Path, target_dir: &Path) -> Result<()> {
         Box::new(file)
     };
 
+    let decoder = super::limited_reader::LimitedReader::new(decoder, max_layer_bytes);
+
     // Extract the tar archive, applying OCI whiteout semantics so files deleted
     // in an upper layer do not reappear from lower layers:
     //   - `.wh.<name>`    deletes the sibling `<name>` already materialized
@@ -164,10 +179,15 @@ pub fn extract_layer(layer_path: &Path, target_dir: &Path) -> Result<()> {
         }
 
         entry.unpack_in(target_dir).map_err(|e| {
+            // Surface the underlying cause (e.g. the LimitedReader's size-cap
+            // error) — tar's wrapper Display alone would just say "failed to
+            // unpack <path>" and hide a decompression-bomb abort from the operator.
+            let cause = std::error::Error::source(&e)
+                .map(|src| format!("{e}: {src}"))
+                .unwrap_or_else(|| e.to_string());
             BoxError::OciImageError(format!(
-                "Failed to extract layer to {}: {}",
+                "Failed to extract layer to {}: {cause}",
                 target_dir.display(),
-                e
             ))
         })?;
     }
@@ -371,6 +391,43 @@ mod tests {
         assert!(!target.join("d/.wh..wh..opq").exists());
     }
 
+    #[test]
+    fn extract_layer_rejects_decompression_bomb_past_cap() {
+        let temp_dir = TempDir::new().unwrap();
+        let layer = temp_dir.path().join("bomb.tar.gz");
+        let target = temp_dir.path().join("out");
+        // 64 KiB of zeros — compresses to almost nothing but exceeds a small cap,
+        // standing in for a real layer that expands to hundreds of GB.
+        let big = vec![0u8; 64 * 1024];
+        create_test_layer(&layer, &[("big", &big)]);
+
+        // A 4 KiB cap must abort the extraction...
+        let result = extract_layer_with_cap(&layer, &target, 4 * 1024);
+        assert!(
+            result.is_err(),
+            "the cap must abort an oversized (bomb) layer, got: {result:?}"
+        );
+        // ...BEFORE the full 64 KiB member is written to disk.
+        let written = std::fs::metadata(target.join("big"))
+            .map(|m| m.len())
+            .unwrap_or(0);
+        assert!(
+            written < 64 * 1024,
+            "cap must bound bytes written before aborting; wrote {written}"
+        );
+    }
+
+    #[test]
+    fn extract_layer_with_generous_cap_extracts_normally() {
+        let temp_dir = TempDir::new().unwrap();
+        let layer = temp_dir.path().join("ok.tar.gz");
+        let target = temp_dir.path().join("out");
+        create_test_layer(&layer, &[("file.txt", b"hello")]);
+        // A generous cap must not regress a normal small layer.
+        extract_layer_with_cap(&layer, &target, 16 * 1024 * 1024).unwrap();
+        assert!(target.join("file.txt").exists());
+    }
+
     // Helper function to create a test tar.gz layer
     fn create_test_layer(path: &Path, files: &[(&str, &[u8])]) {
         use flate2::write::GzEncoder;

src/runtime/src/oci/limited_reader.rs

@@ -0,0 +1,81 @@
+//! A `Read` adapter that fails once a byte budget is exceeded.
+//!
+//! Layer/archive extraction streams a decompressor (gzip/zstd/bzip2/xz) into a
+//! tar reader with no bound on the *decompressed* output. A compression-bomb
+//! layer (a few MB that expands to hundreds of GB) would therefore fill the
+//! host disk during `pull`/build and DoS the host. Wrapping the decompressor in
+//! [`LimitedReader`] caps total decompressed bytes and aborts with a clear error
+//! instead — mirroring the existing `MAX_ADD_URL_BYTES` cap on the ADD-URL path.
+
+use std::io::{self, Read};
+
+/// Wraps a reader and returns an error once more than `limit` bytes have been
+/// read in total. Use it around a decompressor so the tar layer above it cannot
+/// pull an unbounded amount of decompressed data to disk.
+pub(crate) struct LimitedReader<R> {
+    inner: R,
+    remaining: u64,
+    limit: u64,
+}
+
+impl<R: Read> LimitedReader<R> {
+    pub(crate) fn new(inner: R, limit: u64) -> Self {
+        Self {
+            inner,
+            remaining: limit,
+            limit,
+        }
+    }
+}
+
+impl<R: Read> Read for LimitedReader<R> {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        let n = self.inner.read(buf)?;
+        if n as u64 > self.remaining {
+            return Err(io::Error::other(format!(
+                "decompressed output exceeded the {}-byte limit (possible decompression bomb); \
+                 raise the limit via the relevant A3S_BOX_MAX_*_BYTES env var if this is a \
+                 legitimately large image/archive",
+                self.limit
+            )));
+        }
+        self.remaining -= n as u64;
+        Ok(n)
+    }
+}
+
+/// Read a byte-size cap from `var`, falling back to `default_bytes` when unset or
+/// unparseable. Lets operators tune the decompression-bomb ceilings.
+pub(crate) fn cap_from_env(var: &str, default_bytes: u64) -> u64 {
+    std::env::var(var)
+        .ok()
+        .and_then(|v| v.trim().parse::<u64>().ok())
+        .filter(|&v| v > 0)
+        .unwrap_or(default_bytes)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn errors_once_total_read_exceeds_limit() {
+        // 10 KiB of data, 4 KiB cap → must error before delivering it all.
+        let data = vec![0u8; 10 * 1024];
+        let mut r = LimitedReader::new(&data[..], 4 * 1024);
+        let mut sink = Vec::new();
+        let err = std::io::copy(&mut r, &mut sink).unwrap_err();
+        assert_eq!(err.kind(), io::ErrorKind::Other);
+        assert!(sink.len() as u64 <= 4 * 1024, "must not exceed the cap");
+        assert!(err.to_string().contains("decompression bomb"));
+    }
+
+    #[test]
+    fn passes_data_under_the_limit() {
+        let data = vec![7u8; 4096];
+        let mut r = LimitedReader::new(&data[..], 1024 * 1024);
+        let mut sink = Vec::new();
+        std::io::copy(&mut r, &mut sink).unwrap();
+        assert_eq!(sink, data);
+    }
+}

src/runtime/src/oci/mod.rs

@@ -29,6 +29,7 @@ pub mod build;
 pub mod credentials;
 mod image;
 mod layers;
+mod limited_reader;
 mod pull;
 pub mod reference;
 pub mod registry;