From 5a3f2a295e72437955c907f9daa363d6ae16b3df Mon Sep 17 00:00:00 2001 From: udf2457 Date: Fri, 19 Jun 2026 11:30:43 +0100 Subject: [PATCH 1/2] Nil-pointer panic: mapping can reference repos not in Repositories A malformed or adversarially crafted map file could trigger a nil-pointer dereference. If a mapping entry references a repo name that isn't in the `Repositories` map, `client.TUFClients[repoName]` returns `nil`, and the `.GetTargetInfo()` call would panic. Signed-off-by: udf2457 --- metadata/multirepo/multirepo.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/metadata/multirepo/multirepo.go b/metadata/multirepo/multirepo.go index e48cfaf8..f3ac5f37 100644 --- a/metadata/multirepo/multirepo.go +++ b/metadata/multirepo/multirepo.go @@ -102,6 +102,15 @@ func NewConfig(repoMap []byte, roots map[string][]byte) (*MultiRepoConfig, error } } + // validation pass against malformed or adversarially crafted map + for _, m := range mapFile.Mapping { + for _, repo := range m.Repositories { + if _, ok := mapFile.Repositories[repo]; !ok { + return nil, fmt.Errorf("mapping references unknown repository %q", repo) + } + } + } + return &MultiRepoConfig{ RepoMap: mapFile, TrustedRoots: roots, From 6fe96af58807598857ba349b15107dec121951e5 Mon Sep 17 00:00:00 2001 From: udf2457 Date: Fri, 19 Jun 2026 18:44:06 +0100 Subject: [PATCH 2/2] Validate non-null mappings in mapFile Add validation for null mappings in mapFile. Signed-off-by: udf2457 --- metadata/multirepo/multirepo.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/metadata/multirepo/multirepo.go b/metadata/multirepo/multirepo.go index f3ac5f37..7dd9f8d1 100644 --- a/metadata/multirepo/multirepo.go +++ b/metadata/multirepo/multirepo.go @@ -103,7 +103,10 @@ func NewConfig(repoMap []byte, roots map[string][]byte) (*MultiRepoConfig, error } // validation pass against malformed or adversarially crafted map - for _, m := range mapFile.Mapping { + for i, m := range mapFile.Mapping { + if m == nil { + return nil, fmt.Errorf("mapping[%d] is null", i) + } for _, repo := range m.Repositories { if _, ok := mapFile.Repositories[repo]; !ok { return nil, fmt.Errorf("mapping references unknown repository %q", repo)