diff --git a/ebpftracer/tracer.go b/ebpftracer/tracer.go index 160aecb8..a305ad6a 100644 --- a/ebpftracer/tracer.go +++ b/ebpftracer/tracer.go @@ -9,6 +9,7 @@ import ( "fmt" "io" "os" + "unsafe" "path" "runtime" "strconv" @@ -432,13 +433,11 @@ func runEventsReader(name string, r *perf.Reader, ch chan<- Event, typ perfMapTy switch typ { case perfMapTypeL7Events: - v := &l7Event{} - data := rec.RawSample - - if err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, v); err != nil { - klog.Warningln("failed to read l7 event:", err) + if len(rec.RawSample) < int(unsafe.Sizeof(l7Event{})) { + klog.Warningln("l7 event too short") continue } + v := (*l7Event)(unsafe.Pointer(&rec.RawSample[0])) // Extract payload data directly from the struct arrays payloadSize := min(int(v.PayloadSize), len(v.Payload)) @@ -471,18 +470,18 @@ func runEventsReader(name string, r *perf.Reader, ch chan<- Event, typ perfMapTy L7Request: req, } case perfMapTypeFileEvents: - v := &fileEvent{} - if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil { - klog.Warningln("failed to read file event:", err) + if len(rec.RawSample) < int(unsafe.Sizeof(fileEvent{})) { + klog.Warningln("file event too short") continue } + v := (*fileEvent)(unsafe.Pointer(&rec.RawSample[0])) event = Event{Type: v.Type, Pid: v.Pid, Fd: v.Fd, Mnt: v.Mnt, Log: v.Log > 0} case perfMapTypeProcEvents: - v := &procEvent{} - if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil { - klog.Warningln("failed to read proc event:", err) + if len(rec.RawSample) < int(unsafe.Sizeof(procEvent{})) { + klog.Warningln("proc event too short") continue } + v := (*procEvent)(unsafe.Pointer(&rec.RawSample[0])) event = Event{Type: v.Type, Reason: EventReason(v.Reason), Pid: v.Pid} case perfMapTypeTCPEvents: v := &tcpEvent{}