in_kubernetes_events: bound record field parsing to msgpack string length

[saddamr3e]

The Kubernetes events input decodes the API watch/list response with
flb_pack_json and then reads fields out of the resulting msgpack objects.
record_get_field_ptr(), record_get_field_time(),
record_get_field_uint64() and process_event_list() handed the msgpack
string bytes (via.str.ptr) straight to strncmp(), flb_strptime() and
strtoul(). msgpack strings are not NUL terminated, so those C-string scans
run past via.str.size into whatever follows the string in the buffer. The
values parsed this way include metadata.resourceVersion and the
lastTimestamp/firstTimestamp/creationTimestamp fields, plus the map keys.

Guard-page proof (the string is placed flush against a PROT_NONE page, so any
read past its length faults inside libc before the call returns):

calling strtoul on non-terminated buffer...
zsh: segmentation fault  ./repro_guard strtoul

calling strptime on non-terminated buffer...
zsh: segmentation fault  ./repro_guard strptime

Copy each value into a bounded, NUL-terminated stack buffer before parsing and
compare keys by exact length first. Same shape as the out_stackdriver over-read
fix that replaced atoll(obj.via.str.ptr) with a bounded copy. Valid input
behavior is unchanged; the length compare also stops a key that merely shares a
prefix with a looked-up field from matching.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [N/A] Example configuration file for the change
• [N/A] Debug log output from testing the change
• [N/A] Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [N/A] Run local packaging test showing all targets (including any new ones) build.
• [N/A] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [N/A] Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • Improved Kubernetes event handling to safely parse event data from incoming messages.
  • Fixed string matching for event fields to avoid misreading values when message fields are not null-terminated.
  • Improved timestamp and numeric value parsing for better reliability with event payloads.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR hardens Kubernetes event parsing against unsafe operations on non-NUL-terminated msgpack string fields. Key matching functions now verify exact string size before strncmp comparisons, and value parsing functions copy strings into bounded, NUL-terminated buffers before calling flb_strptime and strtoul.

Changes

Safe msgpack string handling

Layer / File(s)	Summary
Field key matching with size validation plugins/in_kubernetes_events/kubernetes_events.c	record_get_field_ptr and process_event_list require the msgpack key's recorded string size to match the expected field name length before running a bounded strncmp, replacing prior strncmp-only checks.
Bounded buffer parsing for time and numeric fields plugins/in_kubernetes_events/kubernetes_events.c	record_get_field_time and record_get_field_uint64 validate string length, copy msgpack string values into fixed-size NUL-terminated local buffers, then call flb_strptime/strtoul on the copies with post-parse validation, replacing direct calls on raw via.str.ptr.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly captures the main fix: bounding Kubernetes event field parsing to msgpack string length.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

plugins/in_kubernetes_events/kubernetes_events.c (1)

260-301: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Move buf and len declarations to the start of the function.

Per the project's coding guidelines, variables should be declared at the start of functions, not mid-block. buf and len at lines 272-273 are declared inside the if (v->type == MSGPACK_OBJECT_STR) block.

♻️ Proposed refactor

 static int record_get_field_uint64(msgpack_object *obj, const char *fieldname, uint64_t *val)
 {
     msgpack_object *v;
     char *end;
+    char buf[32];
+    size_t len;

     v = record_get_field_ptr(obj, fieldname);
     if (v == NULL) {
         return -1;
     }

     /* attempt to parse string as number... */
     if (v->type == MSGPACK_OBJECT_STR) {
-        char buf[32];
-        size_t len = v->via.str.size;
+        len = v->via.str.size;

         /*
          * msgpack strings are not NUL terminated; strtoul() scans until a

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/in_kubernetes_events/kubernetes_events.c` around lines 260 - 301, The
`record_get_field_uint64` function declares `buf` and `len` inside the
`MSGPACK_OBJECT_STR` block, which violates the coding guideline requiring
variables to be declared at the start of the function. Move those declarations
to the top of `record_get_field_uint64` alongside `v` and `end`, then keep the
existing string parsing logic unchanged.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@plugins/in_kubernetes_events/kubernetes_events.c`:
- Around line 260-301: The `record_get_field_uint64` function declares `buf` and
`len` inside the `MSGPACK_OBJECT_STR` block, which violates the coding guideline
requiring variables to be declared at the start of the function. Move those
declarations to the top of `record_get_field_uint64` alongside `v` and `end`,
then keep the existing string parsing logic unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 23ca2dde-8023-43ad-a25f-4f89edd27a1e

📥 Commits

Reviewing files that changed from the base of the PR and between 46e15a1 and fb5758b.

📒 Files selected for processing (1)

• plugins/in_kubernetes_events/kubernetes_events.c