Am 12.10.2012 16:24, schrieb Eric Blake:
> On 10/12/2012 08:09 AM, Stefan Hajnoczi wrote:
>> The qemu-img info --backing-chain option enumerates the backing file
>> chain. For example, for base.qcow2 <- snap1.qcow2 <- snap2.qcow2 the
>> output becomes:
>>
>
>> + do {
>> + bs = bdrv_new_open(filename, fmt, BDRV_O_FLAGS | BDRV_O_NO_BACKING,
>> + false);
>> + if (!bs) {
>> + goto err;
>> + }
>
>> + } while (filename);
>
> Eww - infinite loop if presented with malicious data where someone has
> used 'qemu-img rebase -u' to create a cycle. I think you need a
> followup patch that hashes which files have been opened to date, and
> abort the loop once a cycle is detected.
That would already cause problems in bdrv_open(), so I'd consider it a
separate bug. We should fail gracefully when trying to open such an
image. Once it's open, other code can trust that the chain makes sense.
Kevin
