[pve-devel] [PATCH v3 storage 1/2] fix #3894: cast 'size' and 'used' to integer

[pve-devel] [PATCH v3 storage 1/2] fix #3894: cast 'size' and 'used' to integer

[Mira Limbeck]

Perl's automatic conversion can lead to integers being converted to
strings, for example by matching it in a regex.

To make sure we always return an integer in the API call, add an
explicit cast to integer.

Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Reviewed-by: Fabian Ebner <f.ebner@proxmox.com>
---
v3:
 - fixed style nits
 - added R-b tag
v2:
 - new

 PVE/API2/Storage/Content.pm | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/PVE/API2/Storage/Content.pm b/PVE/API2/Storage/Content.pm
index 45b8de8..8ff858d 100644
--- a/PVE/API2/Storage/Content.pm
+++ b/PVE/API2/Storage/Content.pm
@@ -139,7 +139,9 @@ __PACKAGE__->register_method ({
 	foreach my $item (@$vollist) {
 	    eval {  PVE::Storage::check_volume_access($rpcenv, $authuser, $cfg, undef, $item->{volid}); };
 	    next if $@;
-	    $item->{vmid} = int($item->{vmid}) if (defined($item->{vmid}));
+	    $item->{vmid} = int($item->{vmid}) if defined($item->{vmid});
+	    $item->{size} = int($item->{size}) if defined($item->{size});
+	    $item->{used} = int($item->{used}) if defined($item->{used});
 	    push @$res, $item;
 	}
 
@@ -326,8 +328,8 @@ __PACKAGE__->register_method ({
 
 	my $entry = {
 	    path => $path,
-	    size => $size,
-            used => $used,
+	    size => int($size), # cast to integer in case it was changed to a string previously
+	    used => int($used),
 	    format => $format,
 	};
 
-- 
2.30.2

[pve-devel] [PATCH storage v3 2/2] file_size_info: cast 'size' and 'used' to integer

[Mira Limbeck]

`qemu-img info --output=json` returns the size and used values as integers in
the JSON format, but the regex match converts them to strings.
As we know they only contain digits, we can simply cast them back to integers
after the regex.

The API requires them to be integers.

Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
Reviewed-by: Fabian Ebner <f.ebner@proxmox.com>
---
v3:
 - changed comment to a short one
 - added R-b tag
v2:
 - reworded commit subject and message

 PVE/Storage/Plugin.pm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/PVE/Storage/Plugin.pm b/PVE/Storage/Plugin.pm
index 12f1b4b..8657ff4 100644
--- a/PVE/Storage/Plugin.pm
+++ b/PVE/Storage/Plugin.pm
@@ -892,7 +892,11 @@ sub file_size_info {
     my ($size, $format, $used, $parent) = $info->@{qw(virtual-size format actual-size backing-filename)};
 
     ($size) = ($size =~ /^(\d+)$/) or die "size '$size' not an integer\n"; # untaint
+    # coerce back from string
+    $size = int($size);
     ($used) = ($used =~ /^(\d+)$/) or die "used '$used' not an integer\n"; # untaint
+    # coerce back from string
+    $used = int($used);
     ($format) = ($format =~ /^(\S+)$/) or die "format '$format' includes whitespace\n"; # untaint
     if (defined($parent)) {
 	($parent) = ($parent =~ /^(\S+)$/) or die "parent '$parent' includes whitespace\n"; # untaint
-- 
2.30.2

[pve-devel] applied: [PATCH v3 storage 1/2] fix #3894: cast 'size' and 'used' to integer

[Thomas Lamprecht]

On 18.02.22 09:58, Mira Limbeck wrote:
> Perl's automatic conversion can lead to integers being converted to
> strings, for example by matching it in a regex.
> 
> To make sure we always return an integer in the API call, add an
> explicit cast to integer.
> 
> Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
> Reviewed-by: Fabian Ebner <f.ebner@proxmox.com>
> ---
> v3:
>  - fixed style nits
>  - added R-b tag
> v2:
>  - new
> 
>  PVE/API2/Storage/Content.pm | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
>

applied, thanks!

[pve-devel] applied: [PATCH storage v3 2/2] file_size_info: cast 'size' and 'used' to integer

[Thomas Lamprecht]

On 18.02.22 09:58, Mira Limbeck wrote:
> `qemu-img info --output=json` returns the size and used values as integers in
> the JSON format, but the regex match converts them to strings.
> As we know they only contain digits, we can simply cast them back to integers
> after the regex.
> 
> The API requires them to be integers.
> 
> Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
> Reviewed-by: Fabian Ebner <f.ebner@proxmox.com>
> ---
> v3:
>  - changed comment to a short one
>  - added R-b tag
> v2:
>  - reworded commit subject and message
> 
>  PVE/Storage/Plugin.pm | 4 ++++
>  1 file changed, 4 insertions(+)
> 
>

applied, thanks!