Description: checking applayer name 
 docker-ce (5:20.10.3-15) buster; urgency=low
   * Version: 20.10.3-15
   * checking applayer name 
Author: wanghuaiqing <wanghuaiqing@loongson.com>

---
The information above should follow the Patch Tagging Guidelines, please
checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
are templates for supplementary fields that you might want to add:

Origin: <vendor|upstream|other>, <url of original patch>
Bug: <url in upstream bugtracker>
Bug-Debian: https://bugs.debian.org/<bugnumber>
Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
Forwarded: <no|not-needed|url proving that it has been forwarded>
Reviewed-By: <name and email of someone who approved the patch>
Last-Update: 2022-05-20

--- lcf-utils-1.0.1/src/loongker-ce-20.10.3.orig/sources/engine/daemon/images/image_genapplayer.go
+++ lcf-utils-1.0.1/src/loongker-ce-20.10.3/sources/engine/daemon/images/image_genapplayer.go
@@ -11,12 +11,18 @@ import (
 	"github.com/docker/docker/pkg/streamformatter"
 	"github.com/docker/docker/image/appcompose"
 	"github.com/pkg/errors"
+	"github.com/docker/distribution/reference"
 	digest "github.com/opencontainers/go-digest"
 )
 
 func (i *ImageService) ImageGenApplayer(imageRef string, appname string, outStream io.Writer, quiet bool) error {
 
 	var progressOutput progress.Output
+	_, err := reference.ParseNormalizedNamed(appname)
+	if err != nil {
+		return errors.Errorf("applayer name %s contains invalid character", appname)
+	}
+
 	if !quiet {
 		progressOutput = streamformatter.NewJSONProgressOutput(outStream, false)
 	}
--- lcf-utils-1.0.1/src/loongker-ce-20.10.3.orig/sources/engine/image/applayer_store.go
+++ lcf-utils-1.0.1/src/loongker-ce-20.10.3/sources/engine/image/applayer_store.go
@@ -21,6 +21,7 @@ import (
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/moby/locker"
 	"github.com/docker/docker/pkg/idtools"
+	"github.com/docker/distribution/reference"
 )
 
 var (
@@ -129,6 +130,11 @@ func (as *applayerstore) restore(imageSt
 			logrus.Errorf("not restoring applayer %v without name", dgst)
 			return nil;
 		}
+		_, err = reference.ParseNormalizedNamed(al.name)
+		if err != nil {
+			logrus.Errorf("not restoring applayer %s for invalid name", al.name)
+			return nil;
+		}
 		al.applayerid, err = as.fs.GetApplayerid(dgst)
 		if err != nil {
 			logrus.Errorf("not restoring applayer %v without applayerid", dgst)
--- lcf-utils-1.0.1/src/loongker-ce-20.10.3.orig/sources/engine/image/apptarexport/appload.go
+++ lcf-utils-1.0.1/src/loongker-ce-20.10.3/sources/engine/image/apptarexport/appload.go
@@ -15,6 +15,8 @@ import (
 	"github.com/docker/docker/pkg/system"
 	"github.com/moby/sys/symlink"
 	"github.com/sirupsen/logrus"
+	"github.com/docker/distribution/reference"
+	"github.com/pkg/errors"
 )
 
 func (l *apptarexporter) LoadApp(inTar io.ReadCloser, outStream io.Writer, quiet bool) error {
@@ -50,6 +52,10 @@ func (l *apptarexporter) LoadApp(inTar i
 	if err != nil {
 		return err
 	}
+	_, err = reference.ParseNormalizedNamed(string(name))
+	if err != nil {
+		return errors.Errorf("name of loaded applayer %s contains invalid character", string(name))
+	}
 	tarPath, err := safePath(tmpDir, image.ApplayerFileName)
 	rawTar, err := system.OpenSequential(tarPath)
 	if err != nil {
--- lcf-utils-1.0.1/src/loongker-ce-20.10.3.orig/sources/engine/image/image.go
+++ lcf-utils-1.0.1/src/loongker-ce-20.10.3/sources/engine/image/image.go
@@ -241,6 +241,14 @@ func (img *Image) GetAppLayerID() (strin
 	}
 	return img.Config.Labels["applayerid"], nil
 }
+
+func (img *Image) removeAppLayerID() error {
+	if img.Config == nil {
+		return errors.New("container config of the image is empty")
+	}
+	delete(img.Config.Labels, "applayerid")
+	return nil
+}
 // MarshalJSON serializes the image to JSON. It sorts the top-level keys so
 // that JSON that's been manipulated by a push/pull cycle with a legacy
 // registry won't end up with a different key order.
@@ -426,6 +434,7 @@ func NewApplayerImage(img *Image) *Image
 	}
 	appimg.setdeplen(deplen)
 	appimg.setAppImageflag()
+	appimg.removeAppLayerID()
 	return appimg
 }
 
