filter_record_modifier: dynamic allocate bool_map(fluent#3968)

size of bool_map is fixed 128. If map size of incoming record exceeds the array size, it breaks stack. This patch is to allocate bool_map dynamically. Signed-off-by: Takahiro Yamashita <[email protected]>
nokute78 · Aug 21, 2021 · 3e28833 · 3e28833
1 parent 672c722
commit 3e28833
Showing 1 changed file with 17 additions and 1 deletion.
diff --git a/plugins/filter_record_modifier/filter_modifier.c b/plugins/filter_record_modifier/filter_modifier.c
@@ -262,7 +262,7 @@ static int cb_modifier_filter(const void *data, size_t bytes,
     int i;
     int removed_map_num  = 0;
     int map_num          = 0;
-    bool_map_t bool_map[128];
+    bool_map_t *bool_map = NULL;
     (void) f_ins;
     (void) config;
     struct flb_time tm;
@@ -284,6 +284,11 @@ static int cb_modifier_filter(const void *data, size_t bytes,
     while (msgpack_unpack_next(&result, data, bytes, &off) == MSGPACK_UNPACK_SUCCESS) {
         map_num = 0;
         removed_map_num = 0;
+        if (bool_map != NULL) {
+            flb_free(bool_map);
+            bool_map = NULL;
+        }
+
         if (result.data.type != MSGPACK_OBJECT_ARRAY) {
             continue;
         }
@@ -293,6 +298,12 @@ static int cb_modifier_filter(const void *data, size_t bytes,
         /* grep keys */
         if (obj->type == MSGPACK_OBJECT_MAP) {
             map_num = obj->via.map.size;
+            /* allocate map_num + guard byte */
+            bool_map = flb_calloc(map_num+1, sizeof(bool_map_t));
+            if (bool_map == NULL) {
+                flb_errno();
+                return -1;
+            }
             removed_map_num = make_bool_map(ctx, obj,
                                             bool_map, obj->via.map.size);
         }
@@ -320,6 +331,8 @@ static int cb_modifier_filter(const void *data, size_t bytes,
                 msgpack_pack_object(&tmp_pck, (kv+i)->val);
             }
         }
+        flb_free(bool_map);
+        bool_map = NULL;
 
         /* append record */
         if (ctx->records_num > 0) {
@@ -336,6 +349,9 @@ static int cb_modifier_filter(const void *data, size_t bytes,
         }
     }
     msgpack_unpacked_destroy(&result);
+    if (bool_map != NULL) {
+        flb_free(bool_map);
+    }
 
     if (is_modified != FLB_TRUE) {
         /* Destroy the buffer to avoid more overhead */