From 0a9650365ec879394df7a3af14b80ca18e5c1494 Mon Sep 17 00:00:00 2001 From: Federico Di Pierro Date: Wed, 4 Sep 2024 09:06:53 +0200 Subject: [PATCH 1/2] fix(userspace/libsinsp): fixed possible UB in compute_program_hash() method. Signed-off-by: Federico Di Pierro --- userspace/libsinsp/threadinfo.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/userspace/libsinsp/threadinfo.cpp b/userspace/libsinsp/threadinfo.cpp index 7b08523dd9..837930aa6d 100644 --- a/userspace/libsinsp/threadinfo.cpp +++ b/userspace/libsinsp/threadinfo.cpp @@ -242,7 +242,8 @@ void sinsp_threadinfo::compute_program_hash() // if(m_comm.size() == 4) { - uint32_t ncomm = *(uint32_t*)m_comm.c_str(); + uint32_t ncomm; + memcpy(&ncomm, m_comm.c_str(), 4); if(ncomm == STR_AS_NUM_JAVA || ncomm == STR_AS_NUM_RUBY || ncomm == STR_AS_NUM_PERL || ncomm == STR_AS_NUM_NODE) From bde6e688d3d6ce02471a9dec0a362035e922d238 Mon Sep 17 00:00:00 2001 From: Federico Di Pierro Date: Wed, 4 Sep 2024 10:52:24 +0200 Subject: [PATCH 2/2] fix(userspace/libscap): one more source of UB in source_plugin.c Signed-off-by: Federico Di Pierro --- userspace/libscap/engine/source_plugin/source_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/userspace/libscap/engine/source_plugin/source_plugin.c b/userspace/libscap/engine/source_plugin/source_plugin.c index d225c3577f..ab6ba8b9a4 100644 --- a/userspace/libscap/engine/source_plugin/source_plugin.c +++ b/userspace/libscap/engine/source_plugin/source_plugin.c @@ -210,7 +210,7 @@ static int32_t next(struct scap_engine_handle engine, scap_evt** pevent, uint16_ // Sanity checks in case a plugin implements a non-syscall event source. // If a plugin has event sourcing capability and has a specific ID, then // it is allowed to produce only plugin events of its own event source. - uint32_t* pplugin_id = (uint32_t*)((uint8_t*) evt + sizeof(scap_evt) + 4 + 4); + uint8_t* pplugin_id = (uint8_t*) evt + sizeof(scap_evt) + sizeof(uint32_t) + sizeof(uint32_t); uint32_t plugin_id; memcpy(&plugin_id, pplugin_id, sizeof(plugin_id));