in_kubernetes_events: fix OOB reads from non-NUL-terminated msgpack strings

[zanarellidev]

Summary

record_get_field_uint64() and record_get_field_time() in plugins/in_kubernetes_events/kubernetes_events.c call strtoul() / flb_strptime() directly on msgpack_object.via.str.ptr. msgpack strings are raw, length-prefixed bytes pointing directly into the decode buffer — they are not NUL-terminated — so these C-string functions can read past the field's true boundary. record_get_field_ptr()'s key match via strncmp(k->via.str.ptr, fieldname, strlen(fieldname)) had the same class of issue: no exact-length check, so a key that's a prefix of fieldname could false-match, and comparison length wasn't bounded by the key's own size.

A spec-compliant Kubernetes Event field (e.g. resourceVersion as a digit-only JSON string, per the Kubernetes API docs) placed near the edge of the decode buffer is enough to trigger an out-of-bounds read. Reproduced locally with a harness that calls the real flb_pack_json() on {"resourceVersion":"999999"}, places the resulting buffer against a PROT_NONE guard page, and calls the real (recompiled) plugin function on it — confirmed via lldb: EXC_BAD_ACCESS inside strtoul_l, called from record_get_field_uint64 at the line doing the unbounded strtoul call.

This is the same bug class fixed same-day for the sibling out_stackdriver plugin (#12022, backported in #12170), and the same class that produced a real CVE in this project before (GHSA-5rjf-prwh-pp7q).

A prior contributor flagged the same underlying issue in #12073 but self-closed it without a fix landing; the vulnerable code is still present at HEAD. Filing this with a fix and full explanation/repro so it doesn't fall through again.

Fix

Same pattern the maintainers already established for the sibling out_stackdriver fix: copy the field into a bounded, NUL-terminated stack buffer before parsing (strtoul, flb_strptime), and require an exact length match before the key strncmp.

Test plan

• Full internal ctest suite (90 tests) passes clean after the fix.
• in_kubernetes_events runtime test suite (flb-rt-in_kubernetes_events) passes clean after the fix.
• Reproduced the crash on unmodified code with a guard-page harness (lldb-confirmed EXC_BAD_ACCESS in strtoul_l); same harness runs clean (resource_version=999999, exit 0) after the fix.

Happy to share the repro harness if useful for a permanent regression test — it needs an mmap'd guard page, which doesn't fit cleanly into the existing runtime-test infra (same constraint the maintainers' own #12022 fix had, which also didn't add a crash-reproducing test).

Summary by CodeRabbit

• Bug Fixes
  • Improved Kubernetes event parsing for more accurate field and map key matching.
  • Added validation for timestamp and numeric values, rejecting empty, oversized, malformed, trailing, and overflowing inputs.
  • Prevented negative values from being incorrectly interpreted as unsigned numbers.
  • Ensured invalid timestamps are skipped so valid later timestamp values can be used.
  • Improved handling of malformed event data to prevent incorrect values from being accepted.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4b261786-7358-4581-820f-f410b88a4424

📥 Commits

Reviewing files that changed from the base of the PR and between da330b9 and 9ff6672.

📒 Files selected for processing (1)

• plugins/in_kubernetes_events/kubernetes_events.c

🚧 Files skipped from review as they are similar to previous changes (1)

• plugins/in_kubernetes_events/kubernetes_events.c

---

📝 Walkthrough

Walkthrough

Kubernetes event MessagePack parsing now enforces exact field-name lengths. Timestamp and numeric strings use bounded buffers and strict validation. Negative integers are rejected, and malformed timestamps can fall through to later candidates.

Changes

Kubernetes event parsing

Layer / File(s)	Summary
Exact MessagePack field matching plugins/in_kubernetes_events/kubernetes_events.c	Field lookup requires MessagePack keys to match the requested field-name length before comparing contents.
Bounded timestamp and numeric parsing plugins/in_kubernetes_events/kubernetes_events.c	Timestamp and unsigned integer values use bounded NUL-terminated buffers. Empty, oversized, malformed, trailing, overflowing, and negative values are rejected. Timestamp selection accepts only successfully parsed candidates.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: cosmo0920

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: preventing out-of-bounds reads from non-NUL-terminated MessagePack strings in the Kubernetes events plugin.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@plugins/in_kubernetes_events/kubernetes_events.c`:
- Around line 250-251: Update item_get_timestamp() to treat
record_get_field_time() results other than 0 as failures, including -2 for empty
or oversized timestamp values. Ensure each lastTimestamp, firstTimestamp, and
metadata.creationTimestamp path only returns success when ret == 0, allowing
fallback timestamps to be attempted after malformed values.
- Line 256: Update the timestamp parsing around flb_strptime() to capture its
returned end pointer and require both successful parsing and *end == '\0'. Apply
this validation consistently to lastTimestamp, firstTimestamp, and
metadata.creationTimestamp so trailing characters are rejected.
- Around line 287-295: Update record_get_field_uint64() to parse the copied
string with an explicit unsigned, digits-only conversion instead of accepting
strtoul’s signed or overflowing results. Clear errno before conversion, reject
any non-digit input including signs, reject ERANGE and values exceeding
UINT64_MAX, and preserve the existing invalid-field return behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: df686c53-d865-4bd7-8b94-188fa68f3a35

📥 Commits

Reviewing files that changed from the base of the PR and between f724311 and d96d74e.

📒 Files selected for processing (1)

• plugins/in_kubernetes_events/kubernetes_events.c

[zanarellidev]

Following up on the 3 review comments here (all 3 got auto-marked "Addressed" by CodeRabbit, but the third one wasn't fully closed yet):

1. and 2. (item_get_timestamp() only accepting ret == 0, flb_strptime() requiring *end == '\0'): confirmed fixed already in the pushed history.
2. (reject signed/overflowing resourceVersion): the ERANGE/overflow check was already there, but strtoull() itself still accepted a leading +/-, so "-5" silently wrapped around into 18446744073709551611 instead of being rejected. Added an explicit digits-only check (isdigit() on the first byte) before calling strtoull().

Verified with a standalone guard-page harness (same shape as the earlier OOB reproduction in this PR): before the fix, "-5" returned success with the wrapped value; after the fix, "-5" and "+5" are both rejected, a normal digits-only value still round-trips, and the existing overflow case still correctly fails.

[zanarellidev]

Sorry for the noise here. A local history rewrite (stripping an accidentally-injected co-author trailer) force-pushed while this PR was already closed, which GitHub blocks from reopening ("branch was force-pushed or recreated"). Same fixes, clean history, continued at #12187.