A bug in Starwind StarLVM plugin when making a snapshot on ProxmoxVE with Include RAM enabled

[nvanaert]

image.png (18.12 KiB) Viewed 1005 times

There's one statement, inserted in alloc_image right after $psize = $psize - $free; in /usr/share/perl5/PVE/Storage/Custom/StarLvmPlugin.pm.

A suggested fix for the issue (by Claude and seems to be working):

Code: Select all

          if ($free < $psize) {
              $psize = $psize - $free;
              # untaint: $free is derived from `lvs` output, so $psize is tainted and
              # PVE's daemons run under perl -T. int() does NOT untaint - only a regex
              # capture does. Without this, run_command() dies in IPC::Open3.
              ($psize) = ($psize =~ /^(\d+)(?:\.\d+)?$/)
                  or die "unexpected thin pool extend size for '$vg/$pool'\n";
              $cmd = ['/sbin/lvresize', '-L', "+${psize}k", "$vg/$pool"];
              run_command($cmd, errmsg => "lvresize thin pool '$vg/$pool' to ${psize}k error");
          }

A regex capture is the only thing that clears Perl it's taint flag normally, which is exactly what the int() wrapper fails to do. The optional (?:\.\d+)? group truncates rather than dying if a build ever hands it a float — in 1.1.41 $psize is always integer KiB, so it's belt-and-braces.

Claude's test results:
I've verified it end to end, not just asserted:

in=84398080 -> psize=23580672 tainted=NO exec OK
in=84398080.5 -> psize=23580672 tainted=NO exec OK

Same code path that died with Insecure dependency in exec before the patch.

[yaroslav (staff)]

Thanks for reporting. Could you please also share the proxmox version that you are using?