diff --git a/pkg/internal/ebpf/common/kafka_detect_transform.go b/pkg/internal/ebpf/common/kafka_detect_transform.go index bd6c072c3..dbcd0e705 100644 --- a/pkg/internal/ebpf/common/kafka_detect_transform.go +++ b/pkg/internal/ebpf/common/kafka_detect_transform.go @@ -206,7 +206,7 @@ func getTopicName(pkt []byte, offset int, op Operation, apiVersion int16) (strin } offset += 4 - if offset > len(pkt) { + if offset >= len(pkt) { return "", errors.New("invalid buffer length") } topicNameSize, err := getTopicNameSize(pkt, offset, op, apiVersion) @@ -215,7 +215,7 @@ func getTopicName(pkt []byte, offset int, op Operation, apiVersion int16) (strin } offset += 2 - if offset > len(pkt) { + if offset >= len(pkt) { return "", nil } maxLen := offset + topicNameSize @@ -253,7 +253,7 @@ func getTopicNameSize(pkt []byte, offset int, op Operation, apiVersion int16) (i if err != nil { return 0, err } - } else { + } else if offset < len(pkt) { topicNameSize = int(binary.BigEndian.Uint16(pkt[offset:])) } if topicNameSize <= 0 { diff --git a/pkg/internal/ebpf/common/kafka_detect_transform_test.go b/pkg/internal/ebpf/common/kafka_detect_transform_test.go index f6671259f..96512a80f 100644 --- a/pkg/internal/ebpf/common/kafka_detect_transform_test.go +++ b/pkg/internal/ebpf/common/kafka_detect_transform_test.go @@ -13,6 +13,15 @@ func TestProcessKafkaRequest(t *testing.T) { input []byte expected *KafkaInfo }{ + { + name: "Fetch request (v11) truncated", + input: []byte{0, 0, 0, 94, 0, 1, 0, 11, 0, 0, 0, 224, 0, 6, 115, 97, 114, 97, 109, 97, 255, 255, 255, 255, 0, 0, 1, 244, 0, 0, 0, 1, 6, 64, 0, 0, 0, 0, 0, 0, 0, 255, 255, 255, 255, 0, 0, 0, 1}, + expected: &KafkaInfo{ + ClientID: "sarama", + Operation: Fetch, + TopicOffset: 45, + }, + }, { name: "Fetch request (v11)", input: []byte{0, 0, 0, 94, 0, 1, 0, 11, 0, 0, 0, 224, 0, 6, 115, 97, 114, 97, 109, 97, 255, 255, 255, 255, 0, 0, 1, 244, 0, 0, 0, 1, 6, 64, 0, 0, 0, 0, 0, 0, 0, 255, 255, 255, 255, 0, 0, 0, 1, 0, 9, 105, 109, 112, 111, 114, 116, 97, 110, 116, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 19, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0},