Glance does not sanity-check given image size on upload
Bug #909574 reported by
Ewan Mellor
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Glance |
Fix Released
|
Medium
|
Jay Pipes |
Bug Description
Glance does not sanity-check the value of x-image-meta-size given on upload. Python integers can be arbitrarily large, and the HTTP header can be multiple K, so it's possible to set the image size to ridiculous values. I found this by setting it to 1 << (1 << 20) by accident, which is 300KB when stringified, but is still accepted by Glance.
This causes problems further downstream -- it takes ages to pass the value to the registry (eventually to be truncated at 1 << 63 when it's inserted into the database) and it causes the Swift backend to blow up because it is converted to a float at one point, which raises OverflowError.
Changed in glance: | |
status: | New → In Progress |
assignee: | nobody → Ewan Mellor (ewanmellor) |
description: | updated |
Changed in glance: | |
assignee: | Ewan Mellor (ewanmellor) → Jay Pipes (jaypipes) |
Changed in glance: | |
status: | Fix Committed → Fix Released |
Changed in glance: | |
milestone: | essex-3 → 2012.1 |
To post a comment you must log in.
Hey Ewan, agreed this is a problem. Is your plan to add checks in the client, in the API controller, the Registry controller, or all three?
Thanks much!
-jay