Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions pkg/collector/sharedlibrary/rustchecks/core/src/agent_check.rs
Original file line number Diff line number Diff line change
Expand Up @@ -247,4 +247,18 @@ impl AgentCheck {
event_track_type,
)
}

// TODO(dsec-157): make event_platform_event delegate to this.
pub fn event_platform_event_bytes(
&self,
raw_event: &[u8],
event_track_type: &str,
) -> Result<()> {
self.aggregator.submit_event_platform_event_bytes(
&self.check_id,
raw_event,
raw_event.len() as c_int,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject oversized byte events before the FFI call

When a Rust check builds a binary payload larger than c_int::MAX, this unchecked cast wraps or truncates the byte length before it reaches the C/Go callback. The Go side uses that value as the length passed to C.GoBytes, so an oversized protobuf event can be copied with the wrong length or fail instead of returning a clean Rust error; the Python binding for the same callback has an INT_MAX guard before crossing this boundary. Please use a checked conversion and return the error before invoking the callback.

Useful? React with 👍 / 👎.

@aimenebelfodil aimenebelfodil Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Following the same pattern as the other method
This could however be refined later (not scoped only to this added method)

event_track_type,
)
}
}
28 changes: 28 additions & 0 deletions pkg/collector/sharedlibrary/rustchecks/core/src/aggregator.rs
Original file line number Diff line number Diff line change
Expand Up @@ -286,4 +286,32 @@ impl Aggregator {

Ok(())
}

// TODO(dsec-157): refactor so submit_event_platform_event depends on
// submit_event_platform_event_bytes.
pub fn submit_event_platform_event_bytes(
&self,
check_id: &str,
raw_event: &[u8],
raw_event_size: c_int,
event_type: &str,
) -> Result<()> {
// create C strings guards to automatically free the underlying C strings
let cstr_check_id = CStringGuard::new(check_id)?;
let cstr_event_type = CStringGuard::new(event_type)?;

// `raw_event` needs no guard: it is borrowed (not allocated here) and the
// Go callback copies it synchronously via `C.GoBytes`, so there is nothing
// to free. A `CString` wouldn't work, as protobuf bytes may contain NULs.
let raw_event_ptr = raw_event.as_ptr() as *mut c_char;

(self.cb_submit_event_platform_event)(
cstr_check_id.as_ptr(),
raw_event_ptr,
raw_event_size,
cstr_event_type.as_ptr(),
);

Ok(())
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
other:
- |
Shared-library (Rust) checks can now submit event platform events as raw
bytes, in addition to strings, allowing binary payloads such as protobuf.
Loading