From 6cec70749c2de19cdbe292ee6349d7a1b85d4a04 Mon Sep 17 00:00:00 2001
From: Dean Chen <862469039@qq.com>
Date: Wed, 12 Aug 2026 03:24:39 +0500
Subject: [PATCH] context/store: limit decompressed size of TLS files on import

Zip import already capped meta.json reads at 10MiB but used bare
io.ReadAll for tls/* entries, so a highly compressible zip entry could
inflate far past the archive size limit and OOM the CLI. Apply the same
limitedReader cap to TLS material, and per-entry caps on the tar path.

Fixes #6917

Signed-off-by: Dean Chen <862469039@qq.com>
---
 cli/context/store/store.go | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/cli/context/store/store.go b/cli/context/store/store.go
index 2b8b5c311478..350d8f4e984f 100644
--- a/cli/context/store/store.go
+++ b/cli/context/store/store.go
@@ -403,7 +403,7 @@ func importTar(name string, s Writer, reader io.Reader) error {
 			return fmt.Errorf("%s: %w", hdr.Name, err)
 		}
 		if hdr.Name == metaFile {
-			data, err := io.ReadAll(tr)
+			data, err := io.ReadAll(&limitedReader{R: tr, N: maxAllowedFileSizeToImport})
 			if err != nil {
 				return err
 			}
@@ -416,7 +416,7 @@ func importTar(name string, s Writer, reader io.Reader) error {
 			}
 			importedMetaFile = true
 		} else if strings.HasPrefix(hdr.Name, "tls/") {
-			data, err := io.ReadAll(tr)
+			data, err := io.ReadAll(&limitedReader{R: tr, N: maxAllowedFileSizeToImport})
 			if err != nil {
 				return err
 			}
@@ -478,8 +478,9 @@ func importZip(name string, s Writer, reader io.Reader) error {
 			if err != nil {
 				return err
 			}
-			data, err := io.ReadAll(f)
-			defer f.Close()
+			// Cap decompressed size the same as meta.json (zip bombs).
+			data, err := io.ReadAll(&limitedReader{R: f, N: maxAllowedFileSizeToImport})
+			f.Close()
 			if err != nil {
 				return err
 			}