Skip to content

Commit

Permalink
Fix incorrect handling of event parameters (#4548)
Browse files Browse the repository at this point in the history
If an event that uses parameters is enabled but not present in all policies, a nil access occurs and tracee panics.
This fix makes sure the event is present in each policy before accessing its parameters.
  • Loading branch information
oshaked1 authored Jan 26, 2025
1 parent 582c56a commit a6ea82e
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions pkg/ebpf/event_parameters.go
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,13 @@ func (t *Tracee) handleEventParameters() error {
eventParams := make([]map[string]filters.Filter[*filters.StringFilter], 0)
for iterator := t.policyManager.CreateAllIterator(); iterator.HasNext(); {
policy := iterator.Next()
policyParams := policy.Rules[eventID].DataFilter.GetFieldFilters()
if len(policyParams) == 0 {
continue
if rule, ok := policy.Rules[eventID]; ok {
policyParams := rule.DataFilter.GetFieldFilters()
if len(policyParams) == 0 {
continue
}
eventParams = append(eventParams, policyParams)
}
eventParams = append(eventParams, policyParams)
}
if len(eventParams) == 0 {
// No parameters for this event
Expand Down

0 comments on commit a6ea82e

Please sign in to comment.