)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"7d14dae1691b881746d34a56d8debc3668da58ea","unresolved":true,"context_lines":[{"line_number":14,"context_line":"memory before it can be read. The feature is easily disabled, as it"},{"line_number":15,"context_line":"depends on the availability of the lhafile library."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Closes-Bug: #2172284"},{"line_number":18,"context_line":"Change-Id: Ic9fca12c2d434ea2dbdbaf51dd99a9edca85b119"},{"line_number":19,"context_line":"Signed-off-by: Cyril Roelandt \u003ccyril@redhat.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"4cf602d9_421e8170","line":17,"range":{"start_line":17,"start_character":0,"end_line":17,"end_character":20},"updated":"2026-10-30 06:45:26.000000000","message":"This should be Related-Bug: As we are not fully fixing the bug yet and lha remains vulnerable. We should document about the same.\n\nAlso patch needs releasenote.","commit_id":"58f3ab2495140227f3db7f4f5f3f6d510f0b61e2"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"6eb2702200d4e8d0080b7aaf4fe9b57e729fbd08","unresolved":false,"context_lines":[{"line_number":14,"context_line":"memory before it can be read. The feature is easily disabled, as it"},{"line_number":15,"context_line":"depends on the availability of the lhafile library."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Closes-Bug: #2172284"},{"line_number":18,"context_line":"Change-Id: Ic9fca12c2d434ea2dbdbaf51dd99a9edca85b119"},{"line_number":19,"context_line":"Signed-off-by: Cyril Roelandt \u003ccyril@redhat.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"b28f6e27_443f83be","line":17,"range":{"start_line":17,"start_character":0,"end_line":17,"end_character":20},"in_reply_to":"4cf602d9_421e8170","updated":"2026-10-30 14:03:05.000000000","message":"Done","commit_id":"58f3ab2495140227f3db7f4f5f3f6d510f0b61e2"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"df8e16e977496ed185308f5d1415923b19812eef","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"0a2dbcfd_2ef2924f","updated":"2026-10-29 18:38:14.000000000","message":"So I kept LimitingReader for zipfiles... just to be sure :) \n\nI think this cannot really be fixed for LHA, so maybe I was wrong not to drop the format last time we discussed it.","commit_id":"58f3ab2495140227f3db7f4f5f3f6d510f0b61e2"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"6eb2702200d4e8d0080b7aaf4fe9b57e729fbd08","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"37f01de2_baad6850","updated":"2026-10-30 14:03:05.000000000","message":"Looks good to me, Not sure we document or not about do not use LHA format because of this issue.","commit_id":"c46eb2f6ba4b5411e255ff082642046db9245a4f"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"428a8e98a6c5ec46145566003eb3f9dd92b8abe5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"92f820a3_430119dc","updated":"2026-11-03 13:06:20.000000000","message":"recheck","commit_id":"c46eb2f6ba4b5411e255ff082642046db9245a4f"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"12ca5eae860cf29b709d6605dce447b4237390c8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"b19fc830_edf93bd2","updated":"2026-11-03 07:21:08.000000000","message":"recheck","commit_id":"c46eb2f6ba4b5411e255ff082642046db9245a4f"}],"doc/source/admin/interoperable-image-import.rst":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"bffa2d5b5aac61a7c2a2191395137a0f260b6fa1","unresolved":true,"context_lines":[{"line_number":886,"context_line":""},{"line_number":887,"context_line":".. note::"},{"line_number":888,"context_line":""},{"line_number":889,"context_line":"   While Zip and Gzip files are safe againt \"Zip bombs\", LHA files are not."},{"line_number":890,"context_line":"   See bug 2172284_ for more information."},{"line_number":891,"context_line":""},{"line_number":892,"context_line":".. _2172284: https://bugs.launchpad.net/glance/+bug/2172284"}],"source_content_type":"text/x-rst","patch_set":3,"id":"628bf8b0_e96d7c44","line":889,"range":{"start_line":889,"start_character":37,"end_line":889,"end_character":43},"updated":"2026-10-30 10:51:53.000000000","message":"s/againt/against","commit_id":"fd04a0c4a4ad8062ff1a00f9dee7d3b9b3e63707"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"6eb2702200d4e8d0080b7aaf4fe9b57e729fbd08","unresolved":false,"context_lines":[{"line_number":886,"context_line":""},{"line_number":887,"context_line":".. note::"},{"line_number":888,"context_line":""},{"line_number":889,"context_line":"   While Zip and Gzip files are safe againt \"Zip bombs\", LHA files are not."},{"line_number":890,"context_line":"   See bug 2172284_ for more information."},{"line_number":891,"context_line":""},{"line_number":892,"context_line":".. _2172284: https://bugs.launchpad.net/glance/+bug/2172284"}],"source_content_type":"text/x-rst","patch_set":3,"id":"29e55c4c_1e63a03e","line":889,"range":{"start_line":889,"start_character":37,"end_line":889,"end_character":43},"in_reply_to":"628bf8b0_e96d7c44","updated":"2026-10-30 14:03:05.000000000","message":"Done","commit_id":"fd04a0c4a4ad8062ff1a00f9dee7d3b9b3e63707"}],"glance/async_/flows/plugins/image_decompression.py":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"ce6eaabd76977f0ebce7a59ff3a812cff2467fe4","unresolved":true,"context_lines":[{"line_number":76,"context_line":"                raise Exception(\"Archive contains more than one file.\")"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"            with zfd.open(content[0]) as src:"},{"line_number":79,"context_line":"                limited \u003d LimitingReader(src, CONF.image_size_cap)"},{"line_number":80,"context_line":"                with open(dest_path, \u0027wb\u0027) as dst:"},{"line_number":81,"context_line":"                    shutil.copyfileobj(limited, dst)"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"cab3c604_03746764","line":79,"range":{"start_line":79,"start_character":16,"end_line":79,"end_character":66},"updated":"2026-10-29 10:11:33.000000000","message":"I think rather than adding LimitingReader we should use CONF.image_size_cap with size retrieved like;\nfile_size \u003d zfd.getinfo(content[0]).file_size\n\nAnd then reject if file_size \u003e CONF.image_size_cap","commit_id":"ee57614cd310ed446a3709d9baf938f3273794b2"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"e2366fed631c6539ec778cf3493b2f91ccf22219","unresolved":false,"context_lines":[{"line_number":76,"context_line":"                raise Exception(\"Archive contains more than one file.\")"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"            with zfd.open(content[0]) as src:"},{"line_number":79,"context_line":"                limited \u003d LimitingReader(src, CONF.image_size_cap)"},{"line_number":80,"context_line":"                with open(dest_path, \u0027wb\u0027) as dst:"},{"line_number":81,"context_line":"                    shutil.copyfileobj(limited, dst)"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"58faf2c4_28fd3b79","line":79,"range":{"start_line":79,"start_character":16,"end_line":79,"end_character":66},"in_reply_to":"b79b194c_3ec69992","updated":"2026-10-29 10:53:50.000000000","message":"Sounds good!","commit_id":"ee57614cd310ed446a3709d9baf938f3273794b2"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"14c5f7d11c6f34875cf551ef47fcccbfde6b709d","unresolved":true,"context_lines":[{"line_number":76,"context_line":"                raise Exception(\"Archive contains more than one file.\")"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"            with zfd.open(content[0]) as src:"},{"line_number":79,"context_line":"                limited \u003d LimitingReader(src, CONF.image_size_cap)"},{"line_number":80,"context_line":"                with open(dest_path, \u0027wb\u0027) as dst:"},{"line_number":81,"context_line":"                    shutil.copyfileobj(limited, dst)"},{"line_number":82,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"b79b194c_3ec69992","line":79,"range":{"start_line":79,"start_character":16,"end_line":79,"end_character":66},"in_reply_to":"cab3c604_03746764","updated":"2026-10-29 10:35:02.000000000","message":"My reasoning here is that the Zip file might have \"fake\" headers reporting a small size. It appears this either causes issues with the CRC or just causes Python\u0027s zipfile library to... stop decoding once \"file_size\" bytes have been read, so this works.\n\nI think for gzip, we don\u0027t have such headers though, so would using LimitingReader be ok?","commit_id":"ee57614cd310ed446a3709d9baf938f3273794b2"}]}