CVE fixes suse-v29.4.0 - #12

* hashicorp/memberlist@371698b

limit remote state header values (moby#357)

The header of a push-pull state message contains a count of nodes and user state
length. As an optimization, both of these fields are used to pre-allocate memory
to receive the remote state before copying it off the wire. But if the header
mismatches the actual state, a very small pull-push state message (or at least
one below the message size limit) can be used to consume excess memory on the
receiver.

Limit the memory allocated such that the maximum amount allocated cannot exceed
the maximum actual size of the push-pull state, either in number of nodes or
size of the user state.

Ref: https://hashicorp.atlassian.net/browse/SECVULN-42161
Ref: https://hashicorp.atlassian.net/browse/NMD-1523

hashicorp/memberlist@bc32294

limit user message length (moby#361)

readUserMsg sizes make([]byte, header.UserMsgLen) from the wire header with no bound, so a small userMsg frame declaring a large length forces a large allocation on the receiver. This is the userMsg path of the same issue moby#357 fixed for push-pull state.

Fixes: moby#360

hashicorp/memberlist@7de15ac

limit decompressed message size (moby#363)

decompressBuffer drains the LZW reader with io.Copy into an unbounded buffer, so a small compressMsg expands without limit and can exhaust memory. Cap the output at maxDecompressedBytes with io.CopyN and error past it.

SUSE-Bugs: bsc#1271209<https://bugzilla.suse.com/show_bug.cgi?id=1271209>