From 621ebfbea989498fe4178d364460b3771318d56d Mon Sep 17 00:00:00 2001
From: anushkagupta200615-jpg <anushkagupta200615@gmail.com>
Date: Mon, 13 Jul 2026 23:51:51 +0530
Subject: [PATCH] fix(installer): prevent file descriptor exhaustion during OCI
 plugin extraction

Closes #32344

Signed-off-by: anushkagupta200615-jpg <anushkagupta200615@gmail.com>
---
 internal/plugin/installer/oci_installer.go | 32 ++++++++++++++--------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/internal/plugin/installer/oci_installer.go b/internal/plugin/installer/oci_installer.go
index 383ddb914..a67857a71 100644
--- a/internal/plugin/installer/oci_installer.go
+++ b/internal/plugin/installer/oci_installer.go
@@ -209,6 +209,26 @@ func extractTarGz(r io.Reader, targetDir string) error {
 	return extractTar(gzr, targetDir)
 }
 
+// extractFile creates a single file from the tar archive
+func extractFile(path string, mode int64, src io.Reader) error {
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+
+	outFile, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, os.FileMode(mode))
+	if err != nil {
+		return err
+	}
+	defer outFile.Close()
+
+	if _, err := io.Copy(outFile, src); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // extractTar extracts a tar archive to a directory
 func extractTar(r io.Reader, targetDir string) error {
 	tarReader := tar.NewReader(r)
@@ -233,17 +253,7 @@ func extractTar(r io.Reader, targetDir string) error {
 				return err
 			}
 		case tar.TypeReg:
-			dir := filepath.Dir(path)
-			if err := os.MkdirAll(dir, 0o755); err != nil {
-				return err
-			}
-
-			outFile, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode))
-			if err != nil {
-				return err
-			}
-			defer outFile.Close()
-			if _, err := io.Copy(outFile, tarReader); err != nil {
+			if err := extractFile(path, header.Mode, tarReader); err != nil {
 				return err
 			}
 		case tar.TypeXGlobalHeader, tar.TypeXHeader: