Skip to content

Fix crash in execve filename parameter parsing - #98

Open
Stringy wants to merge 1 commit into
0.23.1-stackroxfrom
giles/fix-execve-filename-crash
Open

Fix crash in execve filename parameter parsing#98
Stringy wants to merge 1 commit into
0.23.1-stackroxfrom
giles/fix-execve-filename-crash

Conversation

@Stringy

@Stringy Stringy commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

Use lenient extraction instead of asstd::string_view() which throws when BPF probe data has unexpected trailing bytes after the null terminator. The uncaught exception propagates through sinsp::next() and aborts the collector.

Use lenient extraction instead of as<std::string_view>() which throws
when BPF probe data has unexpected trailing bytes after the null
terminator. The uncaught exception propagates through sinsp::next()
and aborts the collector.
@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 971fee69-18c4-43bb-bd3e-ff5897ea966e

📥 Commits

Reviewing files that changed from the base of the PR and between fdb2723 and 9d74644.

📒 Files selected for processing (1)
  • userspace/libsinsp/parsers.cpp

📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes
    • Improved process execution event parsing when data includes trailing bytes.
    • Prevented parsing errors while preserving existing handling for unavailable or file-descriptor-based paths.

Walkthrough

The execve exit parser now extracts fallback filenames with bounded strnlen data. This avoids conversion errors when BPF parameters contain trailing bytes. Existing <NA> and file-descriptor path exclusions remain unchanged.

Changes

Exec fallback filename parsing

Layer / File(s) Summary
Bounded fallback filename extraction
userspace/libsinsp/parsers.cpp
The parser reads fallback filename data within its bounded parameter length instead of requiring an exactly null-terminated serialized string.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: fixing a crash during execve filename parameter parsing.
Description check ✅ Passed The description explains the parsing change, the cause of the crash, and its effect on collector stability.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch giles/fix-execve-filename-crash

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant