aquasecurity / aquasecurity/tracee
Vector files capture might use incorrect offsets
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Description
In the code of the `send_bin_helper` function, I noticed that we add to the start offset of the chunk when reading `io_vector` the full size of the last vector written:
```C
bin_args->start_off += bin_args->full_size;
```
However, we also add to this offset while writing (except for the last chunk):
```C
bin_args->start_off += F_CHUNK_SIZE;
```
So, if I am not mistaken, the start offset of the next vector node will be `2*full_size - last_chunk_size`.
We use this offset as the offset for the output file, so it will fill many blank areas in the output file between each vector node.
I haven't tested it yet on captures, only noticed it in the code.
## Output of `tracee version`:
```
(paste your output here)
```
## Output of `uname -a`:
```
(paste your output here)
```
## Additional details
Contributor guide
Research direction
Start at the send_bin_helper function and trace how start_off, full_size, F_CHUNK_SIZE, and io_vector are updated during capture writes. Reproduce the issue with a capture if possible, then verify that successive vector nodes do not leave blank gaps in the output file and add or run coverage for the corrected offsets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, go
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100