search for: fff5cf332

...Instead of using a whitelist for backing formats, just validate that the string is alphanumeric and short. Thanks: Mike Goodwin for reporting the bug. --- lib/create.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/lib/create.c b/lib/create.c index bd4c32ef7..fff5cf332 100644 --- a/lib/create.c +++ b/lib/create.c @@ -241,6 +241,14 @@ is_power_of_2 (unsigned v) return v && ((v & (v - 1)) == 0); } +/** + * Check for valid backing format. Allow any C<^[[:alnum]]+$> + * (in C locale), but limit the length to something reasonable. + */ +#defin...

...to be quoted * properly). * - * guestfs_int_cmd_add_string_unquoted (cmd, "qemu-img info "); + * guestfs_int_cmd_add_string_unquoted (cmd, "file info "); * guestfs_int_cmd_add_string_quoted (cmd, filename); * * =item 4. diff --git a/lib/create.c b/lib/create.c index fff5cf332..b4865172c 100644 --- a/lib/create.c +++ b/lib/create.c @@ -314,7 +314,7 @@ disk_create_qcow2 (guestfs_h *g, const char *orig_filename, int64_t size, } /* Assemble the qemu-img command line. */ - guestfs_int_cmd_add_arg (cmd, "qemu-img"); + guestfs_int_cmd_add_arg (cmd, QEMU_IMG...