Repository navigation
fix(go.d/isc_dhcpd): guard against out-of-range slice when parsing leases - #24122
Saadanjum0 wants to merge 1 commit into
Conversation
…ases
parseDHCPdLeasesFile() matched lines by a loose prefix ("lease", "iaaddr",
"binding state") and then sliced a fixed number of bytes off each end to
recover the value, assuming the line was always long enough. dhcpd.leases
is rewritten/appended by the dhcpd daemon, so the file can be truncated
mid-write at EOF (daemon killed, disk full, process crash). A truncated
line can still satisfy the prefix check while being too short for the
slice, e.g. a line cut short to "lease 1" or "iaaddr 2", and the slice
then panics with "slice bounds out of range".
This does not crash the collector: go.d's job runtime
(src/go/plugin/framework/jobruntime/job_v1.go) already recovers panics in
both Job.collect() and Job.autoDetection(). What actually happens instead:
during collection the panic is recovered every cycle, logged as "PANIC",
and the whole leases file yields zero metrics for that cycle, including
otherwise well-formed leases; during Check()/autodetection the panic
disables autodetection, so the job never starts.
Add cutAffixes(), a single bounds-checked helper shared by all three call
sites, and skip the line instead of panicking when it is too short to
hold the expected value.
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
|
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require reviewTip of the day💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all |
PR Summary by QodoPrevent panics on truncated ISC DHCP lease lines
AI Description
Diagram
High-Level Assessment
Files changed (2)
|
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. 🧰 Additional context used📚 Code guidelines (2)No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughDHCP lease parsing now checks line lengths before extracting addresses and binding states. Tests cover four truncated lease-line forms and a well-formed lease. ChangesDHCP lease parsing
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~8 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to No actionable merge-blocking risk remains for this change after normal checks. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
No issues found across 2 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Architecture diagram
sequenceDiagram
participant Daemon as dhcpd daemon
participant FS as dhcpd.leases file
participant Parser as parseDHCPdLeasesFile()
participant Helper as cutAffixes()
participant Job as go.d Job Runtime
participant Metrics as Metrics Pipeline
Note over Daemon,FS: Runtime data source
Daemon->>FS: Writes/appends lease records (may truncate mid-write on crash)
Note over Parser,Metrics: Collection cycle
Job->>Parser: collect() - read leases file
loop Each line in file
Parser->>Parser: Match prefix (lease / iaaddr / binding state)
alt Matched lease address line
Parser->>Helper: cutAffixes(s, 6, 2)
Helper-->>Parser: value or not-ok (too short)
alt Value ok
Parser->>Parser: netip.ParseAddr() + validate
else Line too short (truncated)
Note over Parser: Skip line, no panic
end
else Matched iaaddr line
Parser->>Helper: cutAffixes(s, 7, 2)
Helper-->>Parser: value or not-ok
alt Value ok
Parser->>Parser: netip.ParseAddr() + validate
else Line too short
Note over Parser: Skip line, no panic
end
else Matched binding state line
Parser->>Helper: cutAffixes(s, 14, 1)
Helper-->>Parser: value or not-ok
alt Value ok
Parser->>Parser: Store binding state
else Line too short
Note over Parser: Skip line, no panic
end
end
end
Parser-->>Job: lease entries (well-formed only)
Job->>Metrics: Send collected lease data
Note over Parser,Metrics: Unhappy path - before fix
Parser->>Parser: Out-of-range slice panic on truncated line
Job->>Job: Recover panic (framework)
Job->>Metrics: Zero metrics for entire file that cycle
Note over Parser,Metrics: Now: malformed lines skipped, valid leases still parsed
|



Problem
parseDHCPdLeasesFile()insrc/go/plugin/go.d/collector/isc_dhcpd/parse.gomatches lines by a loose prefix (
lease,iaaddr,binding state) and thenslices a fixed number of bytes off each end to recover the value, assuming
the line is always long enough:
dhcpd.leasesis rewritten/appended by the dhcpd daemon, so the file can betruncated mid-write at EOF (daemon killed, disk full, process crash). A
truncated line can still satisfy the prefix check while being too short for
the slice — e.g. a line cut short to
lease 1oriaaddr 2. The slice thenpanics:
This does not crash the collector. go.d's job runtime
(
src/go/plugin/framework/jobruntime/job_v1.go) already recovers panics inboth
Job.collect()andJob.autoDetection(). What actually happens instead:PANIC: ..., and the entire leases file yields zero metrics for thatcycle — including any otherwise well-formed leases in the same file.
Check()/autodetection: the panic disables autodetection(
disableAutoDetection()), so the job never starts at all.So the practical impact is silent data loss on an already-running job, or a
job that silently never starts — not a crash. Still worth fixing: a
truncated/malformed leases file otherwise leaves the collector permanently
blind to all leases until the file is fixed or the agent is restarted.
Fix
Added
cutAffixes(), a single bounds-checked helper shared by the threecall sites (lease address, iaaddr address, binding state), that skips the
line when it is too short to hold the expected value instead of panicking.
Testing
Added
parse_test.gowith malformed-line cases simulating a leases filetruncated mid-write (e.g.
lease 1,iaaddr 2, a cut-offbinding stateline) that reproduce the panic on the old code and pass after the fix, plus
a well-formed case. Ran the full existing
isc_dhcpdpackage test suitelocally (temporarily lifting the
darwinbuild exclusion to run on macOS) —all pass with no behavior change for well-formed leases files.
Summary by cubic
Fixes the
isc_dhcpdleases parser panicking whendhcpd.leasescontains lines truncated mid-write (daemon killed, disk full, crash). Previously the framework-recovered panic hid the issue but made the job report zero metrics for the whole file or prevented it from starting; now malformed lines are skipped and well-formed leases still parse.Bug Fixes
cutAffixes()helper shared by the three slice call sites to skip too-short lines instead of panicking.lease,iaaddr, andbinding statelines plus a well-formed case.Written for commit 52724c7. Summary will update on new commits.
Summary by CodeRabbit