From 81711cee34740b5896e7de0a4d1695ce97b543dc Mon Sep 17 00:00:00 2001
From: Jiri Denemark <jdenemar@redhat.com>
Date: Wed, 9 Mar 2011 21:47:06 +0100
Subject: [PATCH] qemu: Escape snapshot name passed to {save,load,del}vm

---
 src/qemu/qemu_monitor_text.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c
index 67e27db9c1..a423212e88 100644
--- a/src/qemu/qemu_monitor_text.c
+++ b/src/qemu/qemu_monitor_text.c
@@ -2566,13 +2566,15 @@ cleanup:
 
 int qemuMonitorTextCreateSnapshot(qemuMonitorPtr mon, const char *name)
 {
-    char *cmd;
+    char *cmd = NULL;
     char *reply = NULL;
     int ret = -1;
+    char *safename;
 
-    if (virAsprintf(&cmd, "savevm \"%s\"", name) < 0) {
+    if (!(safename = qemuMonitorEscapeArg(name)) ||
+        virAsprintf(&cmd, "savevm \"%s\"", safename) < 0) {
         virReportOOMError();
-        return -1;
+        goto cleanup;
     }
 
     if (qemuMonitorHMPCommand(mon, cmd, &reply)) {
@@ -2604,6 +2606,7 @@ int qemuMonitorTextCreateSnapshot(qemuMonitorPtr mon, const char *name)
     ret = 0;
 
 cleanup:
+    VIR_FREE(safename);
     VIR_FREE(cmd);
     VIR_FREE(reply);
     return ret;
@@ -2611,13 +2614,15 @@ cleanup:
 
 int qemuMonitorTextLoadSnapshot(qemuMonitorPtr mon, const char *name)
 {
-    char *cmd;
+    char *cmd = NULL;
     char *reply = NULL;
     int ret = -1;
+    char *safename;
 
-    if (virAsprintf(&cmd, "loadvm \"%s\"", name) < 0) {
+    if (!(safename = qemuMonitorEscapeArg(name)) ||
+        virAsprintf(&cmd, "loadvm \"%s\"", safename) < 0) {
         virReportOOMError();
-        return -1;
+        goto cleanup;
     }
 
     if (qemuMonitorHMPCommand(mon, cmd, &reply)) {
@@ -2660,6 +2665,7 @@ int qemuMonitorTextLoadSnapshot(qemuMonitorPtr mon, const char *name)
     ret = 0;
 
 cleanup:
+    VIR_FREE(safename);
     VIR_FREE(cmd);
     VIR_FREE(reply);
     return ret;
@@ -2667,13 +2673,15 @@ cleanup:
 
 int qemuMonitorTextDeleteSnapshot(qemuMonitorPtr mon, const char *name)
 {
-    char *cmd;
+    char *cmd = NULL;
     char *reply = NULL;
     int ret = -1;
+    char *safename;
 
-    if (virAsprintf(&cmd, "delvm \"%s\"", name) < 0) {
+    if (!(safename = qemuMonitorEscapeArg(name)) ||
+        virAsprintf(&cmd, "delvm \"%s\"", safename) < 0) {
         virReportOOMError();
-        return -1;
+        goto cleanup;
     }
     if (qemuMonitorHMPCommand(mon, cmd, &reply)) {
         qemuReportError(VIR_ERR_OPERATION_FAILED,
@@ -2700,6 +2708,7 @@ int qemuMonitorTextDeleteSnapshot(qemuMonitorPtr mon, const char *name)
     ret = 0;
 
 cleanup:
+    VIR_FREE(safename);
     VIR_FREE(cmd);
     VIR_FREE(reply);
     return ret;