Fix bugs: humanizeBytes panic, IP range logic, dead code, and error handling

image.go

@@ -99,7 +99,10 @@ func createLayerMetadata(layerDir, diffID string, index int, imageConfig *ImageC
 		layerJSON["parent"] = prevDiffID
 	}
 
-	layerJSONBytes, _ := json.Marshal(layerJSON)
+	layerJSONBytes, err := json.Marshal(layerJSON)
+	if err != nil {
+		return fmt.Errorf("failed to marshal layer JSON: %w", err)
+	}
 	return os.WriteFile(filepath.Join(layerDir, "json"), layerJSONBytes, 0644)
 }
 
@@ -138,7 +141,10 @@ func createDockerManifest(ref ImageReference, configDigest string, layerPaths []
 		},
 	}
 
-	manifestJSONBytes, _ := json.Marshal(manifestJSON)
+	manifestJSONBytes, err := json.Marshal(manifestJSON)
+	if err != nil {
+		return fmt.Errorf("failed to marshal manifest JSON: %w", err)
+	}
 	return os.WriteFile(filepath.Join(tempDir, "manifest.json"), manifestJSONBytes, 0644)
 }
 
@@ -151,7 +157,10 @@ func createRepositoriesFile(ref ImageReference, layerPaths []string, tempDir str
 		imageName: {ref.Tag: topLayer},
 	}
 
-	reposBytes, _ := json.Marshal(repositories)
+	reposBytes, err := json.Marshal(repositories)
+	if err != nil {
+		return fmt.Errorf("failed to marshal repositories JSON: %w", err)
+	}
 	return os.WriteFile(filepath.Join(tempDir, "repositories"), reposBytes, 0644)
 }
 

registry.go

@@ -179,7 +179,7 @@ func (c *RegistryClient) Authenticate(ref ImageReference) error {
 	defer closeWithLog(resp.Body, responseBodyStr)
 
 	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
 		return fmt.Errorf("authentication failed: %d - %s", resp.StatusCode, string(body))
 	}
 
@@ -325,7 +325,7 @@ func (c *RegistryClient) getManifest(ref ImageReference) (*ManifestV2, error) {
 	defer closeWithLog(resp.Body, responseBodyStr)
 
 	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
 		return nil, fmt.Errorf("failed to get manifest: %d - %s", resp.StatusCode, string(body))
 	}
 

server.go

@@ -206,11 +206,14 @@ func humanizeBytes(bytes int64) string {
 	if bytes < unit {
 		return fmt.Sprintf("%d B", bytes)
 	}
+	units := []string{"KB", "MB", "GB", "TB", "PB"}
 	div, exp := int64(unit), 0
 	for n := bytes / unit; n >= unit; n /= unit {
 		div *= unit
 		exp++
+		if exp >= len(units)-1 {
+			break
+		}
 	}
-	units := []string{"KB", "MB", "GB", "TB", "PB"}
 	return fmt.Sprintf("%.2f %s", float64(bytes)/float64(div), units[exp])
 }

validation.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/url"
 	"regexp"
+	"strconv"
 	"strings"
 )
 
@@ -60,14 +61,6 @@ func validateRegistry(registry string) error {
 		}
 	}
 
-	if len(parts) == 4 && allNumeric(parts) {
-		for _, part := range parts {
-			if len(part) > 1 && part[0] == '0' {
-				return fmt.Errorf("registry hostname not allowed: %s", registry)
-			}
-		}
-	}
-
 	return nil
 }
 
@@ -90,9 +83,10 @@ func parseIPRange(host string) (bool, bool, bool) {
 
 	isLoopback = host == "127.0.0.1"
 
+	bInt, _ := strconv.Atoi(b)
 	isPrivate = (a == "10") ||
 		(a == "192" && b == "168") ||
-		(a == "172" && b >= "16" && b <= "31") ||
+		(a == "172" && bInt >= 16 && bInt <= 31) ||
 		(a == "169" && b == "254" && c == "169" && d == "254") ||
 		host == "0.0.0.0"