fixes helm#11142 missing array length check on release

aep · Jul 13, 2022 · d248b6f · d248b6f
1 parent 9377988
commit d248b6f
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/pkg/storage/driver/util.go b/pkg/storage/driver/util.go
@@ -60,6 +60,10 @@ func decodeRelease(data string) (*rspb.Release, error) {
 		return nil, err
 	}
 
+	if len(b) < 3 {
+		return nil, errors.New("too short to be a valid gzip")
+	}
+
 	// For backwards compatibility with releases that were stored before
 	// compression was introduced we skip decompression if the
 	// gzip magic header is not found