diff --git a/plugins/in_elasticsearch/in_elasticsearch_bulk_prot.c b/plugins/in_elasticsearch/in_elasticsearch_bulk_prot.c index b647485d249..09c8332b637 100644 --- a/plugins/in_elasticsearch/in_elasticsearch_bulk_prot.c +++ b/plugins/in_elasticsearch/in_elasticsearch_bulk_prot.c @@ -105,7 +105,32 @@ static int status_buffer_avail(struct flb_in_elasticsearch *ctx, flb_sds_t bulk_ return FLB_TRUE; } -static int process_ndpack(struct flb_in_elasticsearch *ctx, flb_sds_t tag, char *buf, size_t size, flb_sds_t bulk_statuses) +static int bulk_statuses_cat(struct flb_in_elasticsearch *ctx, + flb_sds_t *bulk_statuses, + const char *data, size_t len) +{ + flb_sds_t tmp; + + if (flb_sds_avail(*bulk_statuses) < len) { + flb_plg_warn(ctx->ins, "left buffer for bulk status(es) is too small"); + + return FLB_FALSE; + } + + tmp = flb_sds_cat(*bulk_statuses, data, len); + if (!tmp) { + flb_errno(); + + return FLB_FALSE; + } + + *bulk_statuses = tmp; + + return FLB_TRUE; +} + +static int process_ndpack(struct flb_in_elasticsearch *ctx, flb_sds_t tag, char *buf, + size_t size, flb_sds_t *bulk_statuses) { struct flb_log_event_encoder *encoder; struct flb_log_event_encoder local_encoder; @@ -146,9 +171,15 @@ static int process_ndpack(struct flb_in_elasticsearch *ctx, flb_sds_t tag, char while (msgpack_unpack_next(&result, buf, size, &off) == MSGPACK_UNPACK_SUCCESS) { if (result.data.type == MSGPACK_OBJECT_MAP) { if (idx > 0 && idx % 2 == 0) { - flb_sds_cat(bulk_statuses, ",", 1); + if (status_buffer_avail(ctx, *bulk_statuses, 51) == FLB_FALSE) { + break; + } + + if (bulk_statuses_cat(ctx, bulk_statuses, ",", 1) == FLB_FALSE) { + break; + } } - if (status_buffer_avail(ctx, bulk_statuses, 50) == FLB_FALSE) { + else if (status_buffer_avail(ctx, *bulk_statuses, 50) == FLB_FALSE) { break; } if (idx % 2 == 0) { @@ -156,19 +187,36 @@ static int process_ndpack(struct flb_in_elasticsearch *ctx, flb_sds_t tag, char if (op_ret) { if (flb_sds_cmp(write_op, "index", op_str_size) == 0) { - flb_sds_cat(bulk_statuses, "{\"index\":", 9); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"index\":", 9) == FLB_FALSE) { + flb_sds_destroy(write_op); + break; + } error_op = FLB_FALSE; } else if (flb_sds_cmp(write_op, "create", op_str_size) == 0) { - flb_sds_cat(bulk_statuses, "{\"create\":", 10); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"create\":", 10) == FLB_FALSE) { + flb_sds_destroy(write_op); + break; + } error_op = FLB_FALSE; } else if (flb_sds_cmp(write_op, "update", op_str_size) == 0) { - flb_sds_cat(bulk_statuses, "{\"update\":", 10); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"update\":", 10) == FLB_FALSE) { + flb_sds_destroy(write_op); + break; + } error_op = FLB_TRUE; } else if (flb_sds_cmp(write_op, "delete", op_str_size) == 0) { - flb_sds_cat(bulk_statuses, "{\"delete\":{\"status\":404,\"result\":\"not_found\"}}", 46); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"delete\":{\"status\":404,\"result\":\"not_found\"}}", + 46) == FLB_FALSE) { + flb_sds_destroy(write_op); + break; + } error_op = FLB_TRUE; idx += 1; /* Prepare to adjust to multiple of two * in the end of the loop. @@ -178,7 +226,12 @@ static int process_ndpack(struct flb_in_elasticsearch *ctx, flb_sds_t tag, char goto proceed; } else { - flb_sds_cat(bulk_statuses, "{\"unknown\":{\"status\":400,\"result\":\"bad_request\"}}", 49); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"unknown\":{\"status\":400,\"result\":\"bad_request\"}}", + 49) == FLB_FALSE) { + flb_sds_destroy(write_op); + break; + } error_op = FLB_TRUE; flb_sds_destroy(write_op); @@ -315,15 +368,36 @@ static int process_ndpack(struct flb_in_elasticsearch *ctx, flb_sds_t tag, char } if (op_ret) { if (flb_sds_cmp(write_op, "index", op_str_size) == 0) { - flb_sds_cat(bulk_statuses, "{\"status\":201,\"result\":\"created\"}}", 34); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"status\":201,\"result\":\"created\"}}", + 34) == FLB_FALSE) { + flb_sds_destroy(write_op); + write_op = NULL; + + break; + } } else if (flb_sds_cmp(write_op, "create", op_str_size) == 0) { - flb_sds_cat(bulk_statuses, "{\"status\":201,\"result\":\"created\"}}", 34); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"status\":201,\"result\":\"created\"}}", + 34) == FLB_FALSE) { + flb_sds_destroy(write_op); + write_op = NULL; + + break; + } } else if (flb_sds_cmp(write_op, "update", op_str_size) == 0) { - flb_sds_cat(bulk_statuses, "{\"status\":403,\"result\":\"forbidden\"}}", 36); + if (bulk_statuses_cat(ctx, bulk_statuses, + "{\"status\":403,\"result\":\"forbidden\"}}", + 36) == FLB_FALSE) { + flb_sds_destroy(write_op); + write_op = NULL; + + break; + } } - if (status_buffer_avail(ctx, bulk_statuses, 50) == FLB_FALSE) { + if (status_buffer_avail(ctx, *bulk_statuses, 50) == FLB_FALSE) { flb_sds_destroy(write_op); write_op = NULL; @@ -383,7 +457,7 @@ static int process_ndpack(struct flb_in_elasticsearch *ctx, flb_sds_t tag, char } static ssize_t parse_payload_ndjson(struct flb_in_elasticsearch *ctx, flb_sds_t tag, - char *payload, size_t size, flb_sds_t bulk_statuses) + char *payload, size_t size, flb_sds_t *bulk_statuses) { int ret; int out_size; @@ -529,7 +603,7 @@ static int process_payload_ng(struct flb_http_request *request, struct flb_http_response *response, struct flb_in_elasticsearch *context, flb_sds_t tag, - flb_sds_t bulk_statuses) + flb_sds_t *bulk_statuses) { if (request->content_type == NULL) { send_response_ng(response, 400, NULL, "error: header 'Content-Type' is not set\n"); @@ -563,6 +637,7 @@ int in_elasticsearch_bulk_prot_handle_ng(struct flb_http_request *request, int result; flb_sds_t tag; size_t len; + flb_sds_t tmp; bulk_statuses = NULL; bulk_response = NULL; @@ -627,7 +702,7 @@ int in_elasticsearch_bulk_prot_handle_ng(struct flb_http_request *request, return -1; } - result = process_payload_ng(request, response, context, tag, bulk_statuses); + result = process_payload_ng(request, response, context, tag, &bulk_statuses); flb_sds_destroy(tag); @@ -647,20 +722,49 @@ int in_elasticsearch_bulk_prot_handle_ng(struct flb_http_request *request, len = flb_sds_len(bulk_statuses); if (flb_sds_alloc(bulk_response) < len + 27) { - bulk_response = flb_sds_increase(bulk_response, len + 27 - flb_sds_alloc(bulk_response)); + tmp = flb_sds_increase(bulk_response, len + 27 - flb_sds_alloc(bulk_response)); + + if (tmp == NULL) { + flb_sds_destroy(bulk_statuses); + flb_sds_destroy(bulk_response); + return -1; + } + + bulk_response = tmp; } error_str = strstr(bulk_statuses, "\"status\":40"); if (error_str){ - flb_sds_cat(bulk_response, "{\"errors\":true,\"items\":[", 24); + tmp = flb_sds_cat(bulk_response, "{\"errors\":true,\"items\":[", 24); } else { - flb_sds_cat(bulk_response, "{\"errors\":false,\"items\":[", 25); + tmp = flb_sds_cat(bulk_response, "{\"errors\":false,\"items\":[", 25); + } + + if (tmp == NULL) { + flb_sds_destroy(bulk_statuses); + flb_sds_destroy(bulk_response); + return -1; + } + + bulk_response = tmp; + + tmp = flb_sds_cat(bulk_response, bulk_statuses, flb_sds_len(bulk_statuses)); + if (tmp == NULL) { + flb_sds_destroy(bulk_statuses); + flb_sds_destroy(bulk_response); + return -1; } + bulk_response = tmp; - flb_sds_cat(bulk_response, bulk_statuses, flb_sds_len(bulk_statuses)); - flb_sds_cat(bulk_response, "]}", 2); + tmp = flb_sds_cat(bulk_response, "]}", 2); + if (tmp == NULL) { + flb_sds_destroy(bulk_statuses); + flb_sds_destroy(bulk_response); + return -1; + } + bulk_response = tmp; send_json_response_ng(response, 200, bulk_response); diff --git a/plugins/in_node_exporter_metrics/ne_meminfo_linux.c b/plugins/in_node_exporter_metrics/ne_meminfo_linux.c index ec8a28e193a..10db8b8df88 100644 --- a/plugins/in_node_exporter_metrics/ne_meminfo_linux.c +++ b/plugins/in_node_exporter_metrics/ne_meminfo_linux.c @@ -97,7 +97,11 @@ static int meminfo_configure(struct flb_ne *ctx) entry->str[len] = '\0'; flb_sds_len_set(metric_name, 0); - flb_sds_cat(metric_name, entry->str, flb_sds_len(entry->str)); + ret = flb_sds_cat_safe(&metric_name, entry->str, flb_sds_len(entry->str)); + if (ret != 0) { + flb_slist_destroy(&split_list); + goto error; + } /* Metric description */ flb_sds_len_set(metric_desc, 0); @@ -254,8 +258,28 @@ static int meminfo_update(struct flb_ne *ctx) else if (parts == 3) { /* Compose new metric name */ tmp = flb_sds_create_size(256); - flb_sds_cat_safe(&tmp, metric_name, flb_sds_len(metric_name) - 1); - flb_sds_cat_safe(&tmp, "_bytes", 6); + if (!tmp) { + flb_errno(); + flb_slist_destroy(&split_list); + flb_slist_destroy(&list); + return -1; + } + + ret = flb_sds_cat_safe(&tmp, metric_name, flb_sds_len(metric_name) - 1); + if (ret == -1) { + flb_sds_destroy(tmp); + flb_slist_destroy(&split_list); + flb_slist_destroy(&list); + return -1; + } + + ret = flb_sds_cat_safe(&tmp, "_bytes", 6); + if (ret == -1) { + flb_sds_destroy(tmp); + flb_slist_destroy(&split_list); + flb_slist_destroy(&list); + return -1; + } /* Get metric context */ ret = flb_hash_table_get(ctx->meminfo_ht, diff --git a/plugins/out_azure/azure.c b/plugins/out_azure/azure.c index 459563d910a..3932c9f7451 100644 --- a/plugins/out_azure/azure.c +++ b/plugins/out_azure/azure.c @@ -195,6 +195,7 @@ static int build_headers(struct flb_http_client *c, size_t olen; flb_sds_t rfc1123date; flb_sds_t str_hash; + flb_sds_t tmp_sds; struct tm tm = {0}; unsigned char hmac_hash[32] = {0}; int result; @@ -231,13 +232,48 @@ static int build_headers(struct flb_http_client *c, } len = snprintf(tmp, sizeof(tmp) - 1, "%zu\n", content_length); - flb_sds_cat(str_hash, "POST\n", 5); - flb_sds_cat(str_hash, tmp, len); - flb_sds_cat(str_hash, "application/json\n", 17); - flb_sds_cat(str_hash, "x-ms-date:", 10); - flb_sds_cat(str_hash, rfc1123date, flb_sds_len(rfc1123date)); - flb_sds_cat(str_hash, "\n", 1); - flb_sds_cat(str_hash, FLB_AZURE_RESOURCE, sizeof(FLB_AZURE_RESOURCE) - 1); + tmp_sds = flb_sds_cat(str_hash, "POST\n", 5); + if (!tmp_sds) { + goto concat_error; + } + str_hash = tmp_sds; + + tmp_sds = flb_sds_cat(str_hash, tmp, len); + if (!tmp_sds) { + goto concat_error; + } + str_hash = tmp_sds; + + tmp_sds = flb_sds_cat(str_hash, "application/json\n", 17); + if (!tmp_sds) { + goto concat_error; + } + str_hash = tmp_sds; + + tmp_sds = flb_sds_cat(str_hash, "x-ms-date:", 10); + if (!tmp_sds) { + goto concat_error; + } + str_hash = tmp_sds; + + tmp_sds = flb_sds_cat(str_hash, rfc1123date, flb_sds_len(rfc1123date)); + if (!tmp_sds) { + goto concat_error; + } + str_hash = tmp_sds; + + tmp_sds = flb_sds_cat(str_hash, "\n", 1); + if (!tmp_sds) { + goto concat_error; + } + str_hash = tmp_sds; + + tmp_sds = flb_sds_cat(str_hash, FLB_AZURE_RESOURCE, + sizeof(FLB_AZURE_RESOURCE) - 1); + if (!tmp_sds) { + goto concat_error; + } + str_hash = tmp_sds; /* Authorization signature */ result = flb_hmac_simple(FLB_HASH_SHA256, @@ -291,6 +327,12 @@ static int build_headers(struct flb_http_client *c, flb_free(auth); return 0; + +concat_error: + flb_sds_destroy(rfc1123date); + flb_sds_destroy(str_hash); + + return -1; } static void cb_azure_flush(struct flb_event_chunk *event_chunk, diff --git a/plugins/out_azure/azure_conf.c b/plugins/out_azure/azure_conf.c index da31e3c7fca..d8f4f5c544e 100644 --- a/plugins/out_azure/azure_conf.c +++ b/plugins/out_azure/azure_conf.c @@ -136,19 +136,43 @@ struct flb_azure *flb_azure_conf_create(struct flb_output_instance *ins, } if (!ins->host.name) { - flb_sds_cat(ctx->host, ctx->customer_id, - flb_sds_len(ctx->customer_id)); - flb_sds_cat(ctx->host, FLB_AZURE_HOST, sizeof(FLB_AZURE_HOST) - 1); + ret = flb_sds_cat_safe(&ctx->host, ctx->customer_id, + flb_sds_len(ctx->customer_id)); + if (ret != 0) { + flb_azure_conf_destroy(ctx); + return NULL; + } + + ret = flb_sds_cat_safe(&ctx->host, FLB_AZURE_HOST, + sizeof(FLB_AZURE_HOST) - 1); + if (ret != 0) { + flb_azure_conf_destroy(ctx); + return NULL; + } } else { if (!strstr(ins->host.name, ctx->customer_id)) { - flb_sds_cat(ctx->host, ctx->customer_id, - flb_sds_len(ctx->customer_id)); + ret = flb_sds_cat_safe(&ctx->host, ctx->customer_id, + flb_sds_len(ctx->customer_id)); + if (ret != 0) { + flb_azure_conf_destroy(ctx); + return NULL; + } + if (ins->host.name[0] != '.') { - flb_sds_cat(ctx->host, ".", 1); + ret = flb_sds_cat_safe(&ctx->host, ".", 1); + if (ret != 0) { + flb_azure_conf_destroy(ctx); + return NULL; + } } } - flb_sds_cat(ctx->host, ins->host.name, strlen(ins->host.name)); + + ret = flb_sds_cat_safe(&ctx->host, ins->host.name, strlen(ins->host.name)); + if (ret != 0) { + flb_azure_conf_destroy(ctx); + return NULL; + } } @@ -181,9 +205,19 @@ struct flb_azure *flb_azure_conf_create(struct flb_output_instance *ins, flb_azure_conf_destroy(ctx); return NULL; } - flb_sds_cat(ctx->uri, FLB_AZURE_RESOURCE, sizeof(FLB_AZURE_RESOURCE) - 1); - flb_sds_cat(ctx->uri, FLB_AZURE_API_VERSION, - sizeof(FLB_AZURE_API_VERSION) - 1); + ret = flb_sds_cat_safe(&ctx->uri, FLB_AZURE_RESOURCE, + sizeof(FLB_AZURE_RESOURCE) - 1); + if (ret != 0) { + flb_azure_conf_destroy(ctx); + return NULL; + } + + ret = flb_sds_cat_safe(&ctx->uri, FLB_AZURE_API_VERSION, + sizeof(FLB_AZURE_API_VERSION) - 1); + if (ret != 0) { + flb_azure_conf_destroy(ctx); + return NULL; + } flb_plg_info(ctx->ins, "customer_id='%s' host='%s:%i'", ctx->customer_id, ctx->host, ctx->port); diff --git a/plugins/out_azure_kusto/azure_kusto.c b/plugins/out_azure_kusto/azure_kusto.c index 1a8d1df00e0..bb6883463c4 100644 --- a/plugins/out_azure_kusto/azure_kusto.c +++ b/plugins/out_azure_kusto/azure_kusto.c @@ -1058,6 +1058,9 @@ static int azure_kusto_format(struct flb_azure_kusto *ctx, const char *tag, int struct flb_log_event log_event; int ret; flb_sds_t out_buf; + flb_sds_t tmp_buf; + flb_sds_t json_record; + int map_size; /* Create array for all records */ records = flb_mp_count_log_records(data, bytes); @@ -1087,7 +1090,7 @@ static int azure_kusto_format(struct flb_azure_kusto *ctx, const char *tag, int while ((ret = flb_log_event_decoder_next(&log_decoder, &log_event)) == FLB_EVENT_DECODER_SUCCESS) { msgpack_sbuffer_clear(&mp_sbuf); - int map_size = 1; + map_size = 1; if (ctx->include_time_key == FLB_TRUE) { map_size++; } @@ -1151,8 +1154,8 @@ static int azure_kusto_format(struct flb_azure_kusto *ctx, const char *tag, int msgpack_pack_str_body(&mp_pck, "log_attribute_missing", 20); } - flb_sds_t json_record = flb_msgpack_raw_to_json_sds(mp_sbuf.data, mp_sbuf.size, - config->json_escape_unicode); + json_record = flb_msgpack_raw_to_json_sds(mp_sbuf.data, mp_sbuf.size, + config->json_escape_unicode); if (!json_record) { flb_plg_error(ctx->ins, "error converting msgpack to JSON"); flb_sds_destroy(out_buf); @@ -1162,8 +1165,27 @@ static int azure_kusto_format(struct flb_azure_kusto *ctx, const char *tag, int } /* Concatenate the JSON record to the output buffer */ - out_buf = flb_sds_cat(out_buf, json_record, flb_sds_len(json_record)); - out_buf = flb_sds_cat(out_buf, "\n", 1); + tmp_buf = flb_sds_cat(out_buf, json_record, flb_sds_len(json_record)); + if (!tmp_buf) { + flb_plg_error(ctx->ins, "error appending JSON record"); + flb_sds_destroy(json_record); + flb_sds_destroy(out_buf); + msgpack_sbuffer_destroy(&mp_sbuf); + flb_log_event_decoder_destroy(&log_decoder); + return -1; + } + out_buf = tmp_buf; + + tmp_buf = flb_sds_cat(out_buf, "\n", 1); + if (!tmp_buf) { + flb_plg_error(ctx->ins, "error appending JSON record delimiter"); + flb_sds_destroy(json_record); + flb_sds_destroy(out_buf); + msgpack_sbuffer_destroy(&mp_sbuf); + flb_log_event_decoder_destroy(&log_decoder); + return -1; + } + out_buf = tmp_buf; flb_sds_destroy(json_record); } diff --git a/plugins/out_azure_kusto/azure_msiauth.c b/plugins/out_azure_kusto/azure_msiauth.c index a28af5c3adb..384ffa588df 100644 --- a/plugins/out_azure_kusto/azure_msiauth.c +++ b/plugins/out_azure_kusto/azure_msiauth.c @@ -146,6 +146,7 @@ int flb_azure_workload_identity_token_get(struct flb_oauth2 *ctx, const char *to struct flb_http_client *c; flb_sds_t federated_token; flb_sds_t body = NULL; + flb_sds_t tmp; flb_info("[azure workload identity] inside flb_azure_workload_identity_token_get"); @@ -171,22 +172,51 @@ int flb_azure_workload_identity_token_get(struct flb_oauth2 *ctx, const char *to return -1; } - body = flb_sds_cat(body, "client_id=", 10); - body = flb_sds_cat(body, client_id, strlen(client_id)); + tmp = flb_sds_cat(body, "client_id=", 10); + if (!tmp) { + goto body_error; + } + body = tmp; + + tmp = flb_sds_cat(body, client_id, strlen(client_id)); + if (!tmp) { + goto body_error; + } + body = tmp; + /* Use the correct grant_type and length for workload identity */ - body = flb_sds_cat(body, "&grant_type=client_credentials", 30); - body = flb_sds_cat(body, "&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer", 77); - body = flb_sds_cat(body, "&client_assertion=", 18); - body = flb_sds_cat(body, federated_token, flb_sds_len(federated_token)); - /* Use the correct scope and length for Kusto */ - body = flb_sds_cat(body, "&scope=https://help.kusto.windows.net/.default", 46); + tmp = flb_sds_cat(body, "&grant_type=client_credentials", 30); + if (!tmp) { + goto body_error; + } + body = tmp; - if (!body) { - /* This check might be redundant if flb_sds_cat handles errors, but safe */ - flb_error("[azure workload identity] failed to build request body"); - flb_sds_destroy(federated_token); - return -1; + tmp = flb_sds_cat(body, + "&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer", + 77); + if (!tmp) { + goto body_error; + } + body = tmp; + + tmp = flb_sds_cat(body, "&client_assertion=", 18); + if (!tmp) { + goto body_error; } + body = tmp; + + tmp = flb_sds_cat(body, federated_token, flb_sds_len(federated_token)); + if (!tmp) { + goto body_error; + } + body = tmp; + + /* Use the correct scope and length for Kusto */ + tmp = flb_sds_cat(body, "&scope=https://help.kusto.windows.net/.default", 46); + if (!tmp) { + goto body_error; + } + body = tmp; /* Get upstream connection to Azure AD token endpoint */ u_conn = flb_upstream_conn_get(ctx->u); @@ -275,4 +305,11 @@ int flb_azure_workload_identity_token_get(struct flb_oauth2 *ctx, const char *to /* body already destroyed */ return -1; -} \ No newline at end of file + +body_error: + flb_error("[azure workload identity] failed to build request body"); + flb_sds_destroy(federated_token); + flb_sds_destroy(body); + + return -1; +} diff --git a/plugins/out_bigquery/bigquery.c b/plugins/out_bigquery/bigquery.c index 39ece9e9f00..465a55cbafe 100644 --- a/plugins/out_bigquery/bigquery.c +++ b/plugins/out_bigquery/bigquery.c @@ -91,9 +91,12 @@ static int bigquery_jwt_encode(struct flb_bigquery *ctx, char *headers = "{\"alg\": \"RS256\", \"typ\": \"JWT\"}"; unsigned char sha256_buf[32] = {0}; flb_sds_t out; + flb_sds_t tmp; unsigned char sig[256] = {0}; size_t sig_len; + sigd = NULL; + buf_size = (strlen(payload) + strlen(secret)) * 2; buf = flb_malloc(buf_size); if (!buf) { @@ -120,16 +123,32 @@ static int bigquery_jwt_encode(struct flb_bigquery *ctx, } /* Append header */ - out = flb_sds_cat(out, buf, olen); - out = flb_sds_cat(out, ".", 1); + tmp = flb_sds_cat(out, buf, olen); + if (!tmp) { + goto error; + } + out = tmp; + + tmp = flb_sds_cat(out, ".", 1); + if (!tmp) { + goto error; + } + out = tmp; /* Encode Payload */ len = strlen(payload); - bigquery_jwt_base64_url_encode((unsigned char *) buf, buf_size, - (unsigned char *) payload, len, &olen); + ret = bigquery_jwt_base64_url_encode((unsigned char *) buf, buf_size, + (unsigned char *) payload, len, &olen); + if (ret == -1) { + goto error; + } /* Append Payload */ - out = flb_sds_cat(out, buf, olen); + tmp = flb_sds_cat(out, buf, olen); + if (!tmp) { + goto error; + } + out = tmp; /* do sha256() of base64(header).base64(payload) */ ret = flb_hash_simple(FLB_HASH_SHA256, @@ -138,9 +157,7 @@ static int bigquery_jwt_encode(struct flb_bigquery *ctx, if (ret != FLB_CRYPTO_SUCCESS) { flb_plg_error(ctx->ins, "error hashing token"); - flb_free(buf); - flb_sds_destroy(out); - return -1; + goto error; } /* In mbedTLS cert length must include the null byte */ @@ -157,9 +174,7 @@ static int bigquery_jwt_encode(struct flb_bigquery *ctx, if (ret != FLB_CRYPTO_SUCCESS) { flb_plg_error(ctx->ins, "error creating RSA context"); - flb_free(buf); - flb_sds_destroy(out); - return -1; + goto error; } sigd = flb_malloc(2048); @@ -170,10 +185,22 @@ static int bigquery_jwt_encode(struct flb_bigquery *ctx, return -1; } - bigquery_jwt_base64_url_encode((unsigned char *) sigd, 2048, sig, 256, &olen); + ret = bigquery_jwt_base64_url_encode((unsigned char *) sigd, 2048, sig, 256, &olen); + if (ret == -1) { + goto error; + } + + tmp = flb_sds_cat(out, ".", 1); + if (!tmp) { + goto error; + } + out = tmp; - out = flb_sds_cat(out, ".", 1); - out = flb_sds_cat(out, sigd, olen); + tmp = flb_sds_cat(out, sigd, olen); + if (!tmp) { + goto error; + } + out = tmp; *out_signature = out; *out_size = flb_sds_len(out); @@ -182,6 +209,13 @@ static int bigquery_jwt_encode(struct flb_bigquery *ctx, flb_free(sigd); return 0; + +error: + flb_free(buf); + flb_free(sigd); + flb_sds_destroy(out); + + return -1; } /* Create a new oauth2 context and get a oauth2 token */ diff --git a/plugins/out_stackdriver/gce_metadata.c b/plugins/out_stackdriver/gce_metadata.c index 6032fe85069..f988575d8bf 100644 --- a/plugins/out_stackdriver/gce_metadata.c +++ b/plugins/out_stackdriver/gce_metadata.c @@ -44,15 +44,21 @@ static int fetch_metadata(struct flb_stackdriver *ctx, /* If runtime test mode is enabled, add test data */ if (ctx->ins->test_mode == FLB_TRUE) { if (strcmp(uri, FLB_STD_METADATA_PROJECT_ID_URI) == 0) { - flb_sds_cat(payload, "fluent-bit-test", 15); + if (!flb_sds_cat(payload, "fluent-bit-test", 15)) { + return -1; + } return 0; } else if (strcmp(uri, FLB_STD_METADATA_ZONE_URI) == 0) { - flb_sds_cat(payload, "projects/0123456789/zones/fluent", 32); + if (!flb_sds_cat(payload, "projects/0123456789/zones/fluent", 32)) { + return -1; + } return 0; } else if (strcmp(uri, FLB_STD_METADATA_INSTANCE_ID_URI) == 0) { - flb_sds_cat(payload, "333222111", 9); + if (!flb_sds_cat(payload, "333222111", 9)) { + return -1; + } return 0; } return -1; @@ -112,11 +118,38 @@ static int fetch_metadata(struct flb_stackdriver *ctx, int gce_metadata_read_token(struct flb_stackdriver *ctx) { int ret; - flb_sds_t uri = flb_sds_create(FLB_STD_METADATA_SERVICE_ACCOUNT_URI); - flb_sds_t payload = flb_sds_create_size(FLB_STD_METADATA_TOKEN_SIZE_MAX); + flb_sds_t tmp; + flb_sds_t uri; + flb_sds_t payload; + + uri = flb_sds_create(FLB_STD_METADATA_SERVICE_ACCOUNT_URI); + payload = flb_sds_create_size(FLB_STD_METADATA_TOKEN_SIZE_MAX); + + if (!uri || !payload) { + flb_sds_destroy(payload); + flb_sds_destroy(uri); + + return -1; + } + + tmp = flb_sds_cat(uri, ctx->client_email, flb_sds_len(ctx->client_email)); + if (!tmp) { + flb_sds_destroy(payload); + flb_sds_destroy(uri); + + return -1; + } + uri = tmp; + + tmp = flb_sds_cat(uri, "/token", 6); + if (!tmp) { + flb_sds_destroy(payload); + flb_sds_destroy(uri); + + return -1; + } + uri = tmp; - uri = flb_sds_cat(uri, ctx->client_email, flb_sds_len(ctx->client_email)); - uri = flb_sds_cat(uri, "/token", 6); ret = fetch_metadata(ctx, ctx->metadata_u, uri, payload); if (ret != 0) { flb_plg_error(ctx->ins, "can't fetch token from the metadata server"); diff --git a/plugins/out_stackdriver/stackdriver.c b/plugins/out_stackdriver/stackdriver.c index 38fefd7a8fd..c956c72db0f 100644 --- a/plugins/out_stackdriver/stackdriver.c +++ b/plugins/out_stackdriver/stackdriver.c @@ -246,9 +246,12 @@ static int jwt_encode(char *payload, char *secret, char *headers = "{\"alg\": \"RS256\", \"typ\": \"JWT\"}"; unsigned char sha256_buf[32] = {0}; flb_sds_t out; + flb_sds_t tmp; unsigned char sig[256] = {0}; size_t sig_len; + sigd = NULL; + buf_size = (strlen(payload) + strlen(secret)) * 2; buf = flb_malloc(buf_size); if (!buf) { @@ -275,16 +278,32 @@ static int jwt_encode(char *payload, char *secret, } /* Append header */ - flb_sds_cat(out, buf, olen); - flb_sds_cat(out, ".", 1); + tmp = flb_sds_cat(out, buf, olen); + if (!tmp) { + goto error; + } + out = tmp; + + tmp = flb_sds_cat(out, ".", 1); + if (!tmp) { + goto error; + } + out = tmp; /* Encode Payload */ len = strlen(payload); - jwt_base64_url_encode((unsigned char *) buf, buf_size, - (unsigned char *) payload, len, &olen); + ret = jwt_base64_url_encode((unsigned char *) buf, buf_size, + (unsigned char *) payload, len, &olen); + if (ret == -1) { + goto error; + } /* Append Payload */ - flb_sds_cat(out, buf, olen); + tmp = flb_sds_cat(out, buf, olen); + if (!tmp) { + goto error; + } + out = tmp; /* do sha256() of base64(header).base64(payload) */ ret = flb_hash_simple(FLB_HASH_SHA256, @@ -293,9 +312,7 @@ static int jwt_encode(char *payload, char *secret, if (ret != FLB_CRYPTO_SUCCESS) { flb_plg_error(ctx->ins, "error hashing token"); - flb_free(buf); - flb_sds_destroy(out); - return -1; + goto error; } len = strlen(secret); @@ -310,9 +327,7 @@ static int jwt_encode(char *payload, char *secret, if (ret != FLB_CRYPTO_SUCCESS) { flb_plg_error(ctx->ins, "error creating RSA context"); - flb_free(buf); - flb_sds_destroy(out); - return -1; + goto error; } sigd = flb_malloc(2048); @@ -323,10 +338,22 @@ static int jwt_encode(char *payload, char *secret, return -1; } - jwt_base64_url_encode((unsigned char *) sigd, 2048, sig, 256, &olen); + ret = jwt_base64_url_encode((unsigned char *) sigd, 2048, sig, 256, &olen); + if (ret == -1) { + goto error; + } - flb_sds_cat(out, ".", 1); - flb_sds_cat(out, sigd, olen); + tmp = flb_sds_cat(out, ".", 1); + if (!tmp) { + goto error; + } + out = tmp; + + tmp = flb_sds_cat(out, sigd, olen); + if (!tmp) { + goto error; + } + out = tmp; *out_signature = out; *out_size = flb_sds_len(out); @@ -335,6 +362,13 @@ static int jwt_encode(char *payload, char *secret, flb_free(sigd); return 0; + +error: + flb_free(buf); + flb_free(sigd); + flb_sds_destroy(out); + + return -1; } /* Create a new oauth2 context and get a oauth2 token */ diff --git a/plugins/out_stackdriver/stackdriver_conf.c b/plugins/out_stackdriver/stackdriver_conf.c index 7c36b2e02b9..edacc616824 100644 --- a/plugins/out_stackdriver/stackdriver_conf.c +++ b/plugins/out_stackdriver/stackdriver_conf.c @@ -183,6 +183,7 @@ static int parse_key_value_list(struct flb_stackdriver *ctx, char *p; flb_sds_t key; flb_sds_t val; + flb_sds_t tmp_sds; struct flb_kv *kv; struct mk_list *head; struct flb_slist_entry *entry; @@ -199,23 +200,52 @@ static int parse_key_value_list(struct flb_stackdriver *ctx, } key = flb_sds_create_size((p - entry->str) + 1); - flb_sds_cat(key, entry->str, p - entry->str); + if (!key) { + flb_plg_error(ctx->ins, + "cannot allocate key for '%s'", + entry->str); + return -1; + } + + tmp_sds = flb_sds_cat(key, entry->str, p - entry->str); + if (!tmp_sds) { + flb_plg_error(ctx->ins, + "cannot copy key for '%s'", + entry->str); + flb_sds_destroy(key); + return -1; + } + key = tmp_sds; + val = flb_sds_create(p + 1); + if (!val) { + flb_plg_error(ctx->ins, + "invalid key value pair on '%s'", + entry->str); + flb_sds_destroy(key); + return -1; + } + if (shouldTrim) { flb_sds_trim(key); flb_sds_trim(val); } - if (!key || flb_sds_len(key) == 0) { + + if (flb_sds_len(key) == 0) { flb_plg_error(ctx->ins, "invalid key value pair on '%s'", entry->str); + flb_sds_destroy(key); + flb_sds_destroy(val); return -1; } - if (!val || flb_sds_len(val) == 0) { + + if (flb_sds_len(val) == 0) { flb_plg_error(ctx->ins, "invalid key value pair on '%s'", entry->str); flb_sds_destroy(key); + flb_sds_destroy(val); return -1; } @@ -264,6 +294,7 @@ struct flb_stackdriver *flb_stackdriver_conf_create(struct flb_output_instance * size_t http_request_key_size; struct cmt_histogram_buckets *buckets; flb_sds_t cloud_logging_base_url_str; + flb_sds_t tmp_sds; size_t cloud_logging_base_url_size, cloud_logging_write_url_size; /* Allocate config context */ @@ -548,7 +579,17 @@ struct flb_stackdriver *flb_stackdriver_conf_create(struct flb_output_instance * if (ctx->tag_prefix == NULL && ctx->resource_type == RESOURCE_TYPE_K8S) { /* allocate the flb_sds_t to tag_prefix_k8s so we can safely deallocate it */ ctx->tag_prefix_k8s = flb_sds_create(ctx->resource); - ctx->tag_prefix_k8s = flb_sds_cat(ctx->tag_prefix_k8s, ".", 1); + if (!ctx->tag_prefix_k8s) { + flb_stackdriver_conf_destroy(ctx); + return NULL; + } + + tmp_sds = flb_sds_cat(ctx->tag_prefix_k8s, ".", 1); + if (!tmp_sds) { + flb_stackdriver_conf_destroy(ctx); + return NULL; + } + ctx->tag_prefix_k8s = tmp_sds; ctx->tag_prefix = ctx->tag_prefix_k8s; } diff --git a/tests/integration/scenarios/in_elasticsearch/tests/test_in_elasticsearch_001.py b/tests/integration/scenarios/in_elasticsearch/tests/test_in_elasticsearch_001.py index 489da8928a0..f0ca62462c8 100644 --- a/tests/integration/scenarios/in_elasticsearch/tests/test_in_elasticsearch_001.py +++ b/tests/integration/scenarios/in_elasticsearch/tests/test_in_elasticsearch_001.py @@ -325,7 +325,7 @@ def test_in_elasticsearch_bulk_small_status_buffer_does_not_crash(case): # The regression condition is process termination from a reachable double-free. # Response formatting can still vary under constrained buffer settings, but the # parser must not take down the process. - assert curl_result.returncode in {0, 56} + assert curl_result.returncode in {0, 55, 56} assert health_result["status_code"] == 200