From the cinder point of view, keeping in mind the subject of this particular CVE, I think the current patch that uses 'qemu-img info' to detect the presence of the data file is sufficient.
The issue of using 'qemu-img info' at all is a different CVE, and will take more time to address, perhaps with Dan's format inspector approach, or maybe at the qemu-img level (because it's really hard to believe that the 'info' call can't be used safely).
From the cinder point of view, keeping in mind the subject of this particular CVE, I think the current patch that uses 'qemu-img info' to detect the presence of the data file is sufficient.
The issue of using 'qemu-img info' at all is a different CVE, and will take more time to address, perhaps with Dan's format inspector approach, or maybe at the qemu-img level (because it's really hard to believe that the 'info' call can't be used safely).