Attempting to use proc.a* fields (%proc.aname, %proc.apid...) in output w/o argument results in undefined behavior #2229
Description
Describe the bug
According to the documentation, fields like proc.aname do not make sense in output by themselves but only in filters. So proc.aname = bash is legit, My aname is '%proc.aname' is not.
Currently, you can still write an output string like the one above, and this is what happens:
- If
"%proc.aname"is evaluated as-is or at the end of an output string, it'll returnproc.aname[0] - If the formatting token
%proc.anameis in the middle of the output string this results in an unintialized read, asm_argidis NOT set insinsp_filter_check_thread::parse_field_nameand so the behavior is undefined
How to reproduce it
TEST_F(sinsp_formatter_test, repro) {
format("hello |%proc.name| |%proc.aname| end");
std::cout << "----- last_output -----" << std::endl;
std::cout << m_last_output << std::endl;
}Expected behaviour
Either a NULL which is properly handled or a syntax error. Both are acceptable I think. I prefer a syntax error at this point.
Screenshots
Environment
- Falco version:
- System info:
- Cloud provider or hardware configuration:
- OS:
- Kernel:
- Installation method:
Additional context