filter_kubernetes: fix uninitialized mem edge case

[runderwo]

In some cases of malformed input, the k8s filter attempts to process an input of length 0. In those cases, the root type would be left uninitialized, but subsequently relied upon anyway. This change treats a length 0 input as an invalid JSON document, and additionally initializes the root type ahead of time as a guard condition.

Example valgrind trace that is fixed:

==1== Thread 2 flb-pipeline:
==1== Conditional jump or move depends on uninitialised value(s)
==1==    at 0x3CA765: UnknownInlinedFun (kubernetes.c:188)
==1==    by 0x3CA765: UnknownInlinedFun (kubernetes.c:324)
==1==    by 0x3CA765: cb_kube_filter.lto_priv.0 (kubernetes.c:765)
==1==    by 0x2323ED: flb_filter_do (flb_filter.c:202)
==1==    by 0x2283CA: input_chunk_append_raw.lto_priv.0 (flb_input_chunk.c:3078)
==1==    by 0x22BFDD: UnknownInlinedFun (flb_input_chunk.c:3441)
==1==    by 0x22BFDD: input_log_append_processed_internal.lto_priv.0 (flb_input_log.c:1512)
==1==    by 0x22E7C5: input_log_append.lto_priv.0 (flb_input_log.c:1594)
==1==    by 0x2E0BA6: UnknownInlinedFun (flb_input_log.c:1616)
==1==    by 0x2E0BA6: UnknownInlinedFun (tail_file.c:570)
==1==    by 0x2E0BA6: process_content (tail_file.c:985)
==1==    by 0x2E106B: flb_tail_file_chunk (tail_file.c:2056)
==1==    by 0x2D5C64: in_tail_collect_static.lto_priv.0 (tail.c:200)
==1==    by 0x224DDA: flb_input_collector_fd (flb_input.c:2522)
==1==    by 0x252902: UnknownInlinedFun (flb_engine.c:742)
==1==    by 0x252902: flb_engine_start (flb_engine.c:1146)
==1==    by 0x216730: flb_lib_worker (flb_lib.c:909)
==1==    by 0x545F2E9: start_thread (in /usr/lib64/libc.so.6)

No new valgrind traces emerged.

While I am happy to do the extensive due diligence below if really necessary, it doesn't occur to me as immediately necessary.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [ N/A ] Example configuration file for the change

• [ N/A ] Debug log output from testing the change

• [ N/A ] Attached Valgrind output that shows no leaks or memory corruption was found

• [ N/A ] Run local packaging test showing all targets (including any new ones) build.

• [ N/A ] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [ N/A ] Documentation required for this feature

Backporting

• [ N/A ] Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • Improved JSON handling to avoid unpredictable behavior in certain parsing paths.
  • Zero-length JSON inputs are now rejected earlier, returning an error instead of continuing processing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cbc2e9a7-a898-4bc9-aeaf-1207a2ec2b26

📥 Commits

Reviewing files that changed from the base of the PR and between 5fd6b28 and 3eadb8f.

📒 Files selected for processing (2)

• plugins/filter_kubernetes/kubernetes.c
• src/flb_pack.c

---

📝 Walkthrough

Walkthrough

This PR contains two small defensive fixes: initializing the root_type variable to FLB_PACK_JSON_UNDEFINED in the Kubernetes filter's merge log handler, and adding a len == 0 check to reject zero-length input earlier in the yyjson-based JSON-to-MsgPack packer.

Changes

Defensive JSON Parsing Fixes

Layer / File(s)	Summary
Uninitialized variable and input validation fixes plugins/filter_kubernetes/kubernetes.c, src/flb_pack.c	root_type is now initialized before use in merge_log_handler(), and pack_json_to_msgpack_yyjson now rejects zero-length input (len == 0) along with existing null checks.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main fix: an uninitialized-memory edge case in filter_kubernetes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[runderwo]

The commit subject linter seems to be broken.

[cosmo0920]

Our commit Linter complains as follows:

[2](https://github.com/fluent/fluent-bit/actions/runs/29025702669/job/86145102178?pr=12078#step:6:13)
❌ Commit 3eadb8f00f failed:
Subject prefix 'filter_kubernetes:' does not match files changed.
Expected one of: filter_kubernetes:, pack:


Commit prefix validation failed.
Error: Process completed with exit code 1.

Could you split your commit into 2 commits? This is because your commit includes core component and plugin component changes in the one commit. We didn't want to mix these changes in commits.