openstack
/
glance
Code Issues Proposed changes
OpenStack Image Management (Glance)
7,598 Commits
13 Branches
33 Tags
123 MiB
Python 99.9%
 
Go to file
Guillaume Espanel 06a18202ab Limit CaptureRegion sizes in format_inspector for VMDK and VHDX 
VMDK:
When parsing a VMDK file to calculate its size, the format_inspector
determines the location of the Descriptor section by reading two
uint64 from the headers of the file and uses them to create the
descriptor CaptureRegion.

It would be possible to craft a VMDK file that commands the
format_inspector to create a very big CaptureRegion, thus exhausting
resources on the glance-api process.

This patch binds the beginning of the descriptor to 0x200 and limits
the size of the CaptureRegion to 1MB, similar to how the VMDK
descriptor is parsed by qemu.

VHDX:
It is a bit more involved, but similar: when looking for the
VIRTUAL_DISK_SIZE metadata, the format_inspector was creating an
unbounded CaptureRegion.

In the same way as it seems to be done in Qemu, we now limit the upper
bound of this CaptureRegion.

Closes-Bug: #2006490
Change-Id: I3ec5a33df20e1cfb6673f4ff1c7c91aacd065532
(cherry picked from commit d4d33ee30f)
 		2023-02-07 16:49:15 +00:00
api-ref/source Add documentation for glance-download plugin 2022-08-26 05:46:12 +00:00
doc Minor fix on Interoperable Image Import admin doc 2022-08-30 13:35:51 +01:00
etc Refresh Glance example configs for zed milestone 3 2022-08-29 07:29:04 +00:00
glance Limit CaptureRegion sizes in format_inspector for VMDK and VHDX 2023-02-07 16:49:15 +00:00
httpd Modify wrong file path in README 2022-06-06 14:21:03 +00:00
playbooks Add fips check jobs 2022-02-03 13:19:20 -05:00
rally-jobs Update some url links of rally/README.rst 2018-02-27 00:29:38 -08:00
releasenotes Imported Translations from Zanata 2022-09-11 03:37:31 +00:00
tools Add fips check jobs 2022-02-03 13:19:20 -05:00
.coveragerc Update .coveragerc after the removal of openstack directory 2016-10-17 17:09:56 +05:30
.gitignore Move policy defaults into code 2020-01-06 12:56:30 -05:00
.gitreview Update .gitreview for stable/zed 2022-09-14 17:19:24 +00:00
.mailmap Add a mailmap entry for myself 2014-02-11 12:00:44 +08:00
.stestr.conf Use group_regex to serialize scrubber tests 2018-06-07 09:25:04 -04:00
.zuul.yaml [stable-only] Remove glance-code-constants-check 2022-11-03 10:37:07 -04:00
CONTRIBUTING.rst Community Goal: Project PTL & Contrib Docs Update 2020-03-11 06:09:47 +00:00
HACKING.rst Fix URLs in the form docs.openstack.org/developer/$project 2022-07-05 19:23:33 +02:00
LICENSE Add a LICENSE file. 2012-01-03 10:14:01 -05:00
README.rst Start README.rst with a better title 2019-11-13 17:03:44 +01:00
bindep.txt Bindep fixes for SUSE-like systems 2022-06-15 23:07:06 +02:00
requirements.txt Add missing oslo_limit options 2022-07-05 22:00:11 +09:00
setup.cfg Implement glance-download internal plugin 2022-08-23 08:26:52 -07:00
setup.py Cleanup old cruft 2020-03-28 08:18:01 +01:00
test-requirements.txt Remove Babel requirement 2022-03-08 02:16:01 +01:00
tox.ini Fix tox4 error 2022-12-27 13:35:24 -06:00

README.rst

OpenStack Glance

The following tags have been asserted for the Glance project: "project:official", "tc:approved-release", "stable:follows-policy", "tc:starter-kit:compute", "vulnerability:managed", "assert:supports-upgrade", "assert:follows-standard-deprecation". Follow the link for an explanation of these tags.

Glance is an OpenStack project that provides services and associated libraries to store, browse, share, distribute and manage bootable disk images, other data closely associated with initializing compute resources, and metadata definitions.

Use the following resources to learn more:

API

To learn how to use Glance's API, consult the documentation available online at:

Developers

For information on how to contribute to Glance, please see the contents of the CONTRIBUTING.rst in this repository.

Any new code must follow the development guidelines detailed in the HACKING.rst file, and pass all unit tests.

Further developer focused documentation is available at:

Operators

To learn how to deploy and configure OpenStack Glance, consult the documentation available online at:

In the unfortunate event that bugs are discovered, they should be reported to the appropriate bug tracker. You can raise bugs here:

Release notes

To learn more about Glance's new features, optimizations, and changes between versions, consult the release notes online at:

Other Information

During each design summit, we agree on what the whole community wants to focus on for the upcoming release. You can see image service plans:

For more information about the Glance project please see: