internal/driver: guard BuildID slice in locateBinaries to prevent panic on short BuildID

[evilgensec]

Summary

locateBinaries in internal/driver/fetch.go constructs an LLVM debug-file path by slicing m.BuildID[:2] and m.BuildID[2:] (line 433). The guard at line 424 only checks m.BuildID != "", so a BuildID with fewer than two characters passes the check and causes a panic:

runtime error: slice bounds out of range [:2] with length 1

The profile.proto format places no minimum length requirement on the build_id field, and profile.CheckValid() does not validate it. A crafted profile file with build_id = "X" (or any single-byte value) reliably panics any process that calls locateBinaries.

Impact

Any tool or server that accepts a user-supplied profile and analyzes it (symbolization, flamegraph rendering, etc.) can be crashed by this one-byte build_id. This includes:

• The standalone pprof binary run by an operator against an untrusted profile
• Any service that wraps pprof as a library and accepts uploaded profiles

Fix

Add len(m.BuildID) >= 2 guard before the LLVM path construction. This matches the documented precondition of the LLVM build-id convention ("the first two characters are used as the directory name").

Test

Added BuildID: "X" case to TestSymbolizationPath — this panicked before the fix and passes after.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.59%. Comparing base (545e8a4) to head (7497371).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #998      +/-   ##
==========================================
+ Coverage   70.46%   72.59%   +2.12%     
==========================================
  Files          44       44              
  Lines        9877     7793    -2084     
==========================================
- Hits         6960     5657    -1303     
+ Misses       2893     2112     -781     
  Partials       24       24              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.