new(libsinsp/tests): add test for corrupted event

Signed-off-by: Luca Guerra <[email protected]>

userspace/libsinsp/filter_compare.cpp

@@ -19,6 +19,7 @@ limitations under the License.
 #include <libsinsp/filter_compare.h>
 #include <libsinsp/sinsp_exception.h>
 #include <libsinsp/utils.h>
+#include <libsinsp/memmem.h>
 
 #ifdef _WIN32
 #define NOMINMAX
@@ -30,41 +31,6 @@ limitations under the License.
 #include <netdb.h>
 #endif
 
-//
-// Fallback implementation of memmem
-//
-#if !defined(_GNU_SOURCE) && !defined(__APPLE__)
-#include <string.h>
-
-static inline void *memmem(const void *haystack, size_t haystacklen,
-	const void *needle, size_t needlelen)
-{
-	const unsigned char *ptr;
-	const unsigned char *end;
-
-	if(needlelen == 0)
-	{
-		return (void *)haystack;
-	}
-
-	if(haystacklen < needlelen)
-	{
-		return NULL;
-	}
-
-	end = (const unsigned char *)haystack + haystacklen - needlelen;
-	for(ptr = (const unsigned char *)haystack; ptr <= end; ptr++)
-	{
-		if(!memcmp(ptr, needle, needlelen))
-		{
-			return (void *)ptr;
-		}
-	}
-
-	return NULL;
-}
-#endif
-
 cmpop str_to_cmpop(std::string_view str)
 {
 	if(str == "=" || str == "==")

userspace/libsinsp/memmem.h

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2024 The Falco Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+*/
+
+//
+// Fallback implementation of memmem
+//
+#if !defined(_GNU_SOURCE) && !defined(__APPLE__)
+#include <string.h>
+
+static inline void *memmem(const void *haystack, size_t haystacklen,
+	const void *needle, size_t needlelen)
+{
+	const unsigned char *ptr;
+	const unsigned char *end;
+
+	if(needlelen == 0)
+	{
+		return (void *)haystack;
+	}
+
+	if(haystacklen < needlelen)
+	{
+		return NULL;
+	}
+
+	end = (const unsigned char *)haystack + haystacklen - needlelen;
+	for(ptr = (const unsigned char *)haystack; ptr <= end; ptr++)
+	{
+		if(!memcmp(ptr, needle, needlelen))
+		{
+			return (void *)ptr;
+		}
+	}
+
+	return NULL;
+}
+#endif

userspace/libsinsp/test/events_param.ut.cpp

@@ -18,6 +18,8 @@ limitations under the License.
 
 #include <gtest/gtest.h>
 
+#include <libsinsp/memmem.h>
+
 #include <sinsp_with_test_input.h>
 #include "test_utils.h"
 
@@ -351,3 +353,32 @@ TEST_F(sinsp_with_test_input, bitmaskparams)
 	evt->get_param_as_str(2, &val_str);
 	ASSERT_STREQ(val_str, "O_RDONLY|O_CLOEXEC");
 }
+
+TEST_F(sinsp_with_test_input, invalid_string_len)
+{
+	add_default_init_thread();
+
+	open_inspector();
+	int64_t test_errno = 0;
+
+	const char *content = "01234567890123456789";
+	size_t content_len = strlen(content);
+
+	// `PPME_SYSCALL_CHDIR_X` is a simple event that uses a `PT_CHARBUF`.
+	add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_CHDIR_E, 0);
+
+	// create a regular event with a string
+	scap_evt *sevt = add_event(increasing_ts(), 1, PPME_SYSCALL_CHDIR_X, 2, test_errno, content);
+
+	// corrupt the event by overwriting a \0 in the middle of the string
+	void* content_ptr = memmem(sevt, sevt->len, content, content_len);
+	static_cast<char*>(content_ptr)[10] = '\0';
+
+	// allow this test to print its own debug logs
+	libsinsp_logger()->add_stderr_log();
+	libsinsp_logger()->set_severity(sinsp_logger::SEV_DEBUG);
+
+	libsinsp_logger()->log("An error message and data dump is expected in this test.", sinsp_logger::SEV_DEBUG);
+	// process the event and generate an error. It will be printed.
+	EXPECT_THROW(advance_ts_get_event(sevt->ts), sinsp_exception);
+}

userspace/libsinsp/test/sinsp_with_test_input.cpp

@@ -37,6 +37,8 @@ sinsp_with_test_input::~sinsp_with_test_input()
 	{
 		free(el);
 	}
+
+	libsinsp_logger()->reset();
 }
 
 void sinsp_with_test_input::open_inspector(sinsp_mode_t mode) {