[arpitjain099]

uncompressedImage.LayerByDiffID ranges over the config's rootfs.diff_ids and then uses that index against imgDescriptor.Layers, which comes from manifest.json. Those two are parsed separately and never compared, so a config declaring more diff_ids than manifest.json lists layers indexes past the end.

The compressed side got this guard in #2304, the uncompressed one didn't. Same mismatch, other direction.

It's reachable from the public API. partial.uncompressedImageExtender.Layers() calls LayerByDiffID for every config diff_id, so tarball.ImageFromPath(...).Layers() on a crafted docker save tarball panics instead of returning an error.

Before the fix, on a two-file tarball with "Layers":[] in manifest.json and one diff_id in the config:

panic: runtime error: index out of range [0] with length 0
    tarball.(*uncompressedImage).LayerByDiffID
        pkg/v1/tarball/image.go:338
    partial.(*uncompressedImageExtender).LayerByDiffID
        pkg/v1/partial/uncompressed.go:209
    partial.(*uncompressedImageExtender).Layers
        pkg/v1/partial/uncompressed.go:198

The guard mirrors #2304's and returns an error. New test TestLayerByDiffIDMoreDiffIDsThanLayers panics without the change and passes with it. go test ./pkg/v1/tarball/... ./pkg/v1/partial/... -count=1 and go vet ./pkg/v1/tarball/... are green.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.14%. Comparing base (b3a7149) to head (fa62f33).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2370   +/-   ##
=======================================
  Coverage   57.13%   57.14%           
=======================================
  Files         166      166           
  Lines       11473    11475    +2     
=======================================
+ Hits         6555     6557    +2     
  Misses       4141     4141           
  Partials      777      777           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.