aquasecurity / aquasecurity/tracee

Vector files capture might use incorrect offsets

Open
#3,818 0 comments 0 reactions 0 assignees View on GitHub
area/capture area/ebpf kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

In the code of the `send_bin_helper` function, I noticed that we add to the start offset of the chunk when reading `io_vector` the full size of the last vector written:
```C
bin_args->start_off += bin_args->full_size;
```
However, we also add to this offset while writing (except for the last chunk):
```C
bin_args->start_off += F_CHUNK_SIZE;
```
So, if I am not mistaken, the start offset of the next vector node will be `2*full_size - last_chunk_size`.
We use this offset as the offset for the output file, so it will fill many blank areas in the output file between each vector node.

I haven't tested it yet on captures, only noticed it in the code.

## Output of `tracee version`:

```
(paste your output here)
```

## Output of `uname -a`:

```
(paste your output here)
```

## Additional details

Contributor guide

Open the contributing guide

Research direction

Start at the send_bin_helper function and trace how start_off, full_size, F_CHUNK_SIZE, and io_vector are updated during capture writes. Reproduce the issue with a capture if possible, then verify that successive vector nodes do not leave blank gaps in the output file and add or run coverage for the corrected offsets.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, go
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.