From 50ee90630098039ce79486d6836e075b57fbe241 Mon Sep 17 00:00:00 2001 From: Giles Hutton Date: Wed, 5 Aug 2026 13:08:31 +0100 Subject: [PATCH] Tolerate mismatched parameter lengths in string extraction Event parameter data can have a recorded length that doesn't match the null-terminated string length. This has been observed on some kernels for both string and integer parameters (e.g. clone3 exe param_len=5 vs strnlen=1, clone flags param_len=597 vs expected 4). Use the full parameter length instead of throwing sinsp_exception, which propagated uncaught through sinsp::next() and crashed the collector via std::unexpected() -> abort(). --- userspace/libsinsp/event.h | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/userspace/libsinsp/event.h b/userspace/libsinsp/event.h index a9edec05e..1beac62cc 100644 --- a/userspace/libsinsp/event.h +++ b/userspace/libsinsp/event.h @@ -213,11 +213,14 @@ inline std::string_view get_event_param_as(const sinsp_evt_par } size_t string_len = strnlen(param_data, param_len); - // We expect the parameter to be exactly one null-terminated string + // We expect the parameter to be exactly one null-terminated string. + // When it doesn't match, use the full parameter length instead. + // Event parameter data can have a recorded length that doesn't match + // the null-terminated string length. This has been observed on some + // kernels for both string and integer parameters (e.g. clone3 exe + // param_len=5 vs strnlen=1, clone flags param_len=597 vs expected 4). if(param_len != string_len + 1) { - // By moving this error string building operation to a separate function - // the compiler is more likely to inline this entire function. - param.throw_invalid_len_error(string_len + 1); + string_len = param_len - 1; } return {param_data, string_len}; @@ -231,14 +234,11 @@ inline std::string get_event_param_as(const sinsp_evt_param& param) } size_t string_len = strnlen(param_data, param_len); - // We expect the parameter to be exactly one null-terminated string if(param_len != string_len + 1) { - // By moving this error string building operation to a separate function - // the compiler is more likely to inline this entire function. - param.throw_invalid_len_error(string_len + 1); + string_len = param_len - 1; } - return std::string(param_data); + return std::string(param_data, string_len); } template<>