This gist demonstrates a bug in Go's archive/tar handling of tar files.
Under certain conditions, tar files generated with Go 1.7 and before cannot
be correctly read with Go 1.8+. While first encountered in Docker, which makes
heavy use of tar files, this gist attempts to make a minimal reproduction
without the Docker code base.
To reproduce this, you'll need respective versions of Go installed in /usr/local/go1.7.6 and /usr/local/go1.8.3. Other methods of version
| version: 0.1 | |
| log: | |
| level: debug | |
| fields: | |
| service: registry | |
| storage: | |
| delete: | |
| enabled: true | |
| http: | |
| addr: :5000 |
| // Package main implements a simple ssh client, roughly similar to the | |
| // standard OpenSSH client. It uses golang.org/x/crypto/ssh and integrates | |
| // with the ssh agent. | |
| // | |
| // Mostly, this demonstrates correct resource management and cleanup, as well | |
| // as command dispatch. Obviously, this has never been vetted for security, so | |
| // please don't use for anything serious. | |
| package main | |
| import ( |
| panic: runtime error: invalid memory address or nil pointer dereference | |
| [signal 0xb code=0x1 addr=0x20 pc=0x78154a] | |
| goroutine 92 [running]: | |
| bufio.(*Writer).flush(0xc208208900, 0x0, 0x0) | |
| /usr/local/go/src/bufio/bufio.go:530 +0xda | |
| bufio.(*Writer).Flush(0xc208208900, 0x0, 0x0) | |
| /usr/local/go/src/bufio/bufio.go:519 +0x3a | |
| net/http.(*response).Flush(0xc2085bfae0) | |
| /usr/local/go/src/net/http/server.go:1047 +0x4c |
I hereby claim:
To claim this, I am signing this object:
| import json | |
| import socket | |
| s = socket.create_connection(("127.0.0.1", 5090)) | |
| s.sendall(json.dumps(({"id": 1, "method": "Hello.Hello", "params": ["hello"]}))) | |
| print s.recv(4096) |