Fix edge condition with kafka request parsing

grafana · Oct 11, 2024 · 420bdb3 · 420bdb3
1 parent bc125f7
commit 420bdb3
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/pkg/internal/ebpf/common/kafka_detect_transform.go b/pkg/internal/ebpf/common/kafka_detect_transform.go
@@ -253,7 +253,7 @@ func getTopicNameSize(pkt []byte, offset int, op Operation, apiVersion int16) (i
 		if err != nil {
 			return 0, err
 		}
-	} else if offset < len(pkt) {
+	} else if offset < (len(pkt) - 1) { // we need at least 2 bytes to read uint16
 		topicNameSize = int(binary.BigEndian.Uint16(pkt[offset:]))
 	}
 	if topicNameSize <= 0 {

diff --git a/pkg/internal/ebpf/common/kafka_detect_transform_test.go b/pkg/internal/ebpf/common/kafka_detect_transform_test.go
@@ -13,6 +13,15 @@ func TestProcessKafkaRequest(t *testing.T) {
 		input    []byte
 		expected *KafkaInfo
 	}{
+		{
+			name:  "Fetch request (v11) truncated - 1",
+			input: []byte{0, 0, 0, 94, 0, 1, 0, 11, 0, 0, 0, 224, 0, 6, 115, 97, 114, 97, 109, 97, 255, 255, 255, 255, 0, 0, 1, 244, 0, 0, 0, 1, 6, 64, 0, 0, 0, 0, 0, 0, 0, 255, 255, 255, 255, 0, 0, 0, 1, 0},
+			expected: &KafkaInfo{
+				ClientID:    "sarama",
+				Operation:   Fetch,
+				TopicOffset: 45,
+			},
+		},
 		{
 			name:  "Fetch request (v11) truncated",
 			input: []byte{0, 0, 0, 94, 0, 1, 0, 11, 0, 0, 0, 224, 0, 6, 115, 97, 114, 97, 109, 97, 255, 255, 255, 255, 0, 0, 1, 244, 0, 0, 0, 1, 6, 64, 0, 0, 0, 0, 0, 0, 0, 255, 255, 255, 255, 0, 0, 0, 1},