Merge pull request #240 from runcom/fix-196

image: error out on duplicate tar entry

image/manifest.go

@@ -121,6 +121,7 @@ func (m *manifest) unpack(w walker, dest string) error {
 }
 
 func unpackLayer(dest string, r io.Reader) error {
+	entries := make(map[string]bool)
 	gz, err := gzip.NewReader(r)
 	if err != nil {
 		return errors.Wrap(err, "error creating gzip reader")
@@ -154,6 +155,10 @@ loop:
 			}
 		}
 		path := filepath.Join(dest, hdr.Name)
+		if entries[path] {
+			return fmt.Errorf("duplicate entry for %s", path)
+		}
+		entries[path] = true
 		rel, err := filepath.Rel(dest, path)
 		if err != nil {
 			return err

image/manifest_test.go

@@ -0,0 +1,50 @@
+package image
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestUnpackLayerDuplicateEntries(t *testing.T) {
+	tmp1, err := ioutil.TempDir("", "test-dup")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tarfile := filepath.Join(tmp1, "test.tar")
+	f, err := os.Create(tarfile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	defer os.RemoveAll(tarfile)
+	gw := gzip.NewWriter(f)
+	tw := tar.NewWriter(gw)
+
+	tw.WriteHeader(&tar.Header{Name: "test", Size: 4, Mode: 0600})
+	io.Copy(tw, bytes.NewReader([]byte("test")))
+	tw.WriteHeader(&tar.Header{Name: "test", Size: 5, Mode: 0600})
+	io.Copy(tw, bytes.NewReader([]byte("test1")))
+	tw.Close()
+	gw.Close()
+
+	r, err := os.Open(tarfile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	tmp2, err := ioutil.TempDir("", "test-dest-unpack")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmp2)
+	if err := unpackLayer(tmp2, r); err != nil && !strings.Contains(err.Error(), "duplicate entry for") {
+		t.Fatalf("Expected to fail with duplicate entry, got %v", err)
+	}
+}