Skip to content

Commit 99a8056

Browse files
lexfreiclaude
andcommitted
fix(image): reject trailing garbage in resize size parameter
Add !iss.eof() check to istringstream parsing so inputs like "100abc" or "100GB" are rejected instead of silently truncating to 100. The CLI path was already protected by regex validation in size_in_mb(), but direct XML-RPC/gRPC API callers were not. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
1 parent a8496f5 commit 99a8056

File tree

2 files changed

+6
-1
lines changed

2 files changed

+6
-1
lines changed

src/image/ImageManagerActions.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1653,7 +1653,7 @@ int ImageManager::resize_image(int iid, const string& size, string& error)
16531653
istringstream iss(size);
16541654
iss >> new_size;
16551655

1656-
if (iss.fail() || new_size <= 0)
1656+
if (iss.fail() || !iss.eof() || new_size <= 0)
16571657
{
16581658
error = "Invalid size value: " + size;
16591659
return -1;

src/oca/go/src/goca/image_test.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,11 @@ func (s *ImageSuite) TestResize(c *C) {
258258
c.Assert(err, NotNil)
259259
c.Assert(err.Error(), Matches, ".*Invalid size.*")
260260

261+
// Resize with trailing garbage should fail (not silently truncate)
262+
err = imageC.Resize("100abc")
263+
c.Assert(err, NotNil)
264+
c.Assert(err.Error(), Matches, ".*Invalid size.*")
265+
261266
// Successful resize to larger size
262267
err = imageC.Resize("2")
263268
c.Assert(err, IsNil)

0 commit comments

Comments
 (0)