fix(modern_bpf): fix args/env retrival in case of large args/env

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · Feb 1, 2024 · 41385b0 · 41385b0
1 parent 0e61a93
commit 41385b0
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h
@@ -397,7 +397,14 @@ static __always_inline void auxmap__store_execve_args(struct auxiliary_map *auxm
 		total_len += arg_len;
 	}
 	/* the sum of all env variables lengths should be `<= MAX_PROC_ARG_ENV` */
-	total_len = total_len & (MAX_PROC_ARG_ENV - 1);
+	if(total_len > MAX_PROC_ARG_ENV)
+	{
+		total_len = MAX_PROC_ARG_ENV;
+	}
+	else
+	{
+		total_len = total_len & (MAX_PROC_ARG_ENV - 1);
+	}
 	auxmap->payload_pos = initial_payload_pos + total_len;
 	push__param_len(auxmap->data, &auxmap->lengths_pos, total_len);
 }