From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:49865) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TNk2X-0007ro-Gr for qemu-devel@nongnu.org; Mon, 15 Oct 2012 08:45:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TNk2N-00020n-Sf for qemu-devel@nongnu.org; Mon, 15 Oct 2012 08:45:01 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60542) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TNk2N-00020h-Iu for qemu-devel@nongnu.org; Mon, 15 Oct 2012 08:44:51 -0400 From: Stefan Hajnoczi Date: Mon, 15 Oct 2012 14:44:16 +0200 Message-Id: <1350305057-6287-3-git-send-email-stefanha@redhat.com> In-Reply-To: <1350305057-6287-1-git-send-email-stefanha@redhat.com> References: <1350305057-6287-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PATCH v2 2/3] qemu-img: Detect backing file chain infinite loops List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , kashyap.cv@gmail.com, =?UTF-8?q?Beno=C3=AEt=20Canet?= , Stefan Hajnoczi A malicious or corruption image can contain an infinite loop of backing files. The qemu-img info --backing-chain command must not hang when such files are encountered. Signed-off-by: Stefan Hajnoczi --- qemu-img.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/qemu-img.c b/qemu-img.c index c717f3e..60a5cc8 100644 --- a/qemu-img.c +++ b/qemu-img.c @@ -1259,6 +1259,11 @@ typedef enum OutputFormat { OFORMAT_HUMAN, } OutputFormat; +static gboolean str_equal_func(gconstpointer a, gconstpointer b) +{ + return strcmp(a, b) == 0; +} + static int img_info(int argc, char **argv) { int c; @@ -1268,6 +1273,7 @@ static int img_info(int argc, char **argv) char *filename, *fmt; BlockDriverState *bs; ImageInfo *info; + GHashTable *filenames; fmt = NULL; output = NULL; @@ -1306,6 +1312,9 @@ static int img_info(int argc, char **argv) } filename = g_strdup(argv[optind++]); + filenames = g_hash_table_new_full(g_str_hash, str_equal_func, + g_free, NULL); + if (output && !strcmp(output, "json")) { output_format = OFORMAT_JSON; } else if (output && !strcmp(output, "human")) { @@ -1320,6 +1329,12 @@ static int img_info(int argc, char **argv) } do { + if (g_hash_table_lookup_extended(filenames, filename, NULL, NULL)) { + error_report("Aborting due to backing file chain infinite loop."); + goto err; + } + g_hash_table_insert(filenames, g_strdup(filename), NULL); + bs = bdrv_new_open(filename, fmt, BDRV_O_FLAGS | BDRV_O_NO_BACKING, false); if (!bs) { @@ -1376,11 +1391,13 @@ static int img_info(int argc, char **argv) if (chain && output_format == OFORMAT_JSON) { printf("]\n"); } + g_hash_table_destroy(filenames); return 0; err: g_free(filename); g_free(fmt); + g_hash_table_destroy(filenames); return 1; } -- 1.7.11.7