Language: Go
Label: vulnerable
CWE: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Code:
	err = sigRepo.ListSignatures(ctx, manifestDesc, func(signatureManifests []ocispec.Descriptor) error {
		for _, sigManifestDesc := range signatureManifests {
			sigBlob, sigDesc, err := sigRepo.FetchSignatureBlob(ctx, sigManifestDesc)
			if err != nil {
				fmt.Fprintf(os.Stderr, "Warning: unable to fetch signature %s due to error: %v\n", sigManifestDesc.Digest.String(), err)
				skippedSignatures = true
				continue
			}

			sigEnvelope, err := signature.ParseEnvelope(sigDesc.MediaType, sigBlob)
			if err != nil {
				logSkippedSignature(sigManifestDesc, err)
				skippedSignatures = true
				continue
			}

			envelopeContent, err := sigEnvelope.Content()
			if err != nil {
				logSkippedSignature(sigManifestDesc, err)
				skippedSignatures = true
				continue
			}

			signedArtifactDesc, err := envelope.DescriptorFromSignaturePayload(&envelopeContent.Payload)
			if err != nil {
				logSkippedSignature(sigManifestDesc, err)
				skippedSignatures = true
				continue
			}

			signatureAlgorithm, err := proto.EncodeSigningAlgorithm(envelopeContent.SignerInfo.SignatureAlgorithm)
			if err != nil {
				logSkippedSignature(sigManifestDesc, err)
				skippedSignatures = true
				continue
			}

			sig := signatureOutput{
				MediaType:             sigDesc.MediaType,
				Digest:                sigManifestDesc.Digest.String(),
				SignatureAlgorithm:    string(signatureAlgorithm),
				SignedAttributes:      getSignedAttributes(opts.outputFormat, envelopeContent),
				UserDefinedAttributes: signedArtifactDesc.Annotations,
				UnsignedAttributes:    getUnsignedAttributes(envelopeContent),
				Certificates:          getCertificates(opts.outputFormat, envelopeContent),
				SignedArtifact:        *signedArtifactDesc,
			}

			// clearing annotations from the SignedArtifact field since they're already
			// displayed as UserDefinedAttributes
			sig.SignedArtifact.Annotations = nil

			output.Signatures = append(output.Signatures, sig)
		}
		return nil
	})