fix(modern_bpf): avoid overflow reading sockaddr_storage

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · May 3, 2024 · 89edcd1 · 89edcd1
1 parent f315326
commit 89edcd1
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h
@@ -630,8 +630,11 @@ static __always_inline void auxmap__store_sockaddr_param(struct auxiliary_map *a
 		 * - socket family.
 		 * - socket_unix_path (sun_path).
 		 */
+		if (addrlen == sizeof(struct sockaddr_storage))
+			addrlen -= 1;
+
 		push__u8(auxmap->data, &auxmap->payload_pos, socket_family_to_scap(socket_family));
-		uint16_t written_bytes = push__charbuf(auxmap->data, &auxmap->payload_pos, start_reading_point, MAX_UNIX_SOCKET_PATH, KERNEL);
+		uint16_t written_bytes = push__charbuf(auxmap->data, &auxmap->payload_pos, start_reading_point, addrlen, KERNEL);
 		final_param_len = FAMILY_SIZE + written_bytes;
 		break;
 	}