fix(statsd source): [OBE-10714] avoid panic on non-char-boundary gauge value slice - #147
Open
piyush-s15 wants to merge 1 commit into
Open
fix(statsd source): [OBE-10714] avoid panic on non-char-boundary gauge value slice#147piyush-s15 wants to merge 1 commit into
piyush-s15 wants to merge 1 commit into
Conversation
…slice Parser::parse's "g" (gauge) branch stripped a leading sign character with a byte-index slice (parts[0][1..]) after checking only whether the first *character* was an ASCII digit. Any gauge value beginning with a multi-byte UTF-8 character (e.g. `±`) made that slice land inside the character's bytes, panicking with "byte index 1 is not a char boundary". In UDP mode (the default statsd config) this panic propagates through handle_errors's catch_unwind to abort_tx to a full Vector process shutdown, so a single unauthenticated UDP datagram (e.g. `x:\xc2\xb11|g`) took down every pipeline sharing the process. Replace the byte-index slice with str::get(1..), which returns None (=> ParseError::Malformed) instead of panicking when the offset isn't on a char boundary. The existing StatsdDeserializer/statsd_udp error paths already handle Malformed without aborting the source, so no other files need to change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
akshayakumar-t
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Parser::parse's"g"(gauge) branch stripped a leading sign character with a byte-index slice(
parts[0][1..]) after checking only whether the first character was an ASCII digit. Any gaugevalue beginning with a multi-byte UTF-8 character (e.g.
±) made that slice land inside thecharacter's bytes and panic (
byte index 1 is not a char boundary). Fixed by replacing it withstr::get(1..), which returnsNone(→ParseError::Malformed) instead of panicking when theoffset isn't on a char boundary.
Why
In UDP mode (the default
statsdsource config) this panic propagates throughhandle_errors'scatch_unwind(topology/mod.rs:59-74) toabort_tx(topology/running.rs:984-985) to a fullVector process shutdown via
SignalTo::Shutdown— a single unauthenticated UDP datagram (e.g.x:\xc2\xb11|g) took down every pipeline sharing the process. CVSS 8.7 (High).How to Test
cargo test --lib sources::statsd::parser::test::gauge_with_multibyte_prefix_does_not_panic—RED pre-fix (panics), GREEN post-fix.
make test SCOPE=sources::statsd— 20/20 passing.printf 'x:\xc2\xb11|g' | nc -u -w0 <host> 8125to astatsdUDP source — processno longer crashes.
Ticket
src/sources/statsd/parser.rs:97cargo clippy(clean) andcargo test(20/20, including a negative test for the exact exploit input).Jira: https://sentinelone.atlassian.net/browse/OBE-10714
🤖 Generated with Claude Code
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com