yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Also affects: ossa
   Importance: Undecided
       Status: New

** Changed in: ossa
       Status: New => In Progress

** Changed in: ossa
   Importance: Undecided => Medium

** Changed in: glance/icehouse
       Status: Incomplete => Invalid

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Glance.
https://bugs.launchpad.net/bugs/1371118

Title:
  Image file stays in store if image has been deleted during upload
  (CVE-2014-9684)

Status in OpenStack Image Registry and Delivery Service (Glance):
  Fix Released
Status in Glance icehouse series:
  Invalid
Status in Glance juno series:
  In Progress
Status in OpenStack Security Advisories:
  In Progress

Bug description:
  When I create a new task in v2 to upload an image, it creates the
  image record in db, sets status to "saving" and then begins the
  uploading.

  If the image is deleted by appropriate API call while its content is
  still being uploaded, an exception is raised and it is not handled in
  the API code. This leads to the fact that the uploaded image file
  stays in a storage and clogs it.

  File "/opt/stack/glance/glance/common/scripts/image_import/main.py", line 62, in _execute 
  uri)
  File "/opt/stack/glance/glance/common/scripts/image_import/main.py", line 95, in import_image
  new_image = image_repo.get(image_id)
  File "/opt/stack/glance/glance/api/authorization.py", line 106, in get
  image = self.image_repo.get(image_id)
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/api/policy.py", line 179, in get
  return super(ImageRepoProxy, self).get(image_id)
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/domain/proxy.py", line 86, in get 
  return self.helper.proxy(self.base.get(item_id))
  File "/opt/stack/glance/glance/db/__init__.py", line 72, in get raise exception.NotFound(msg)
  NotFound: No image found with ID e2285448-a56f-45b1-9e6e-216d2b304967

  This bug is very similar to
  https://bugs.launchpad.net/glance/+bug/1188532, but it relates to task
  mechanism in v2.

To manage notifications about this bug go to:
https://bugs.launchpad.net/glance/+bug/1371118/+subscriptions