fix(modern_bpf): consider arg len = MAX_PROC_ARG_ENV edge case

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · Feb 1, 2024 · fa62e25 · fa62e25
1 parent 41385b0
commit fa62e25
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h
@@ -397,7 +397,7 @@ static __always_inline void auxmap__store_execve_args(struct auxiliary_map *auxm
 		total_len += arg_len;
 	}
 	/* the sum of all env variables lengths should be `<= MAX_PROC_ARG_ENV` */
-	if(total_len > MAX_PROC_ARG_ENV)
+	if(total_len >= MAX_PROC_ARG_ENV)
 	{
 		total_len = MAX_PROC_ARG_ENV;
 	}