df: untaint the result

[pve-common.git] / src / PVE / Tools.pm

diff --git a/src/PVE/Tools.pm b/src/PVE/Tools.pm
index 039c9fb8dae5e2d10cb492b9f41ecf4f08397a91..68c4e68ba934370c4ec05aca5c6cfeee5ca0a516 100644 (file)
--- a/src/PVE/Tools.pm
+++ b/src/PVE/Tools.pm
@@ -851,9 +851,9 @@ sub df {
     $pipe->reader();
 
     my $readvalues = sub {
-       $res->{total} = int(<$pipe>);
-       $res->{used}  = int(<$pipe>);
-       $res->{avail} = int(<$pipe>);
+       $res->{total} = int((<$pipe> =~ /^(\d*)$/)[0]);
+       $res->{used}  = int((<$pipe> =~ /^(\d*)$/)[0]);
+       $res->{avail} = int((<$pipe> =~ /^(\d*)$/)[0]);
     };
     eval {
        run_with_timeout($timeout, $readvalues);