Limit the read length of ioutil.ReadAll in pkg/credentialprovider

Signed-off-by: Haiyan Meng <haiyanmeng@google.com>

pkg/credentialprovider/config.go

@@ -19,7 +19,9 @@ package credentialprovider
 import (
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"os"
@@ -30,6 +32,10 @@ import (
 	"k8s.io/klog"
 )
 
+const (
+	maxReadLength = 10 * 1 << 20 // 10MB
+)
+
 // DockerConfigJson represents ~/.docker/config.json file info
 // see https://github.com/docker/docker/pull/12009
 type DockerConfigJson struct {
@@ -195,11 +201,16 @@ func ReadUrl(url string, client *http.Client, header *http.Header) (body []byte,
 		}
 	}
 
-	contents, err := ioutil.ReadAll(resp.Body)
+	limitedReader := &io.LimitedReader{R: resp.Body, N: maxReadLength}
+	contents, err := ioutil.ReadAll(limitedReader)
 	if err != nil {
 		return nil, err
 	}
 
+	if limitedReader.N <= 0 {
+		return nil, errors.New("the read limit is reached")
+	}
+
 	return contents, nil
 }