[packetbeat] MongoDB parser fix bounds checks by stanek-michal · Pull Request #47925 · elastic/beats

stanek-michal · 2025-12-04T16:43:19Z

Proposed commit message

packetbeat: fix bounds checking in mongodb protocol parser

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
[] I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
I have added an entry in ./changelog/fragments using the changelog tool.

How to test this PR locally

cd packetbeat/protos/mongodb && go test -v ./...

github-actions · 2025-12-04T16:43:29Z

🤖 GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

mergify · 2025-12-04T16:43:56Z

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @stanek-michal? 🙏.
For such, you'll need to label your PR with:

The upcoming major version of the Elastic Stack
The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

elasticmachine · 2025-12-04T16:44:44Z

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

Issues addressed: - Negative message length causing panic in truncate() - Negative BSON document length causing slice bounds panic - Negative or excessive numberReturned in OP_REPLY causing allocation panic - Negative document sequence size in OP_MSG causing integer overflow - Error handling gap in OP_QUERY where first readDocument error was lost

Add tests verifying that malformed packets are properly rejected. Test coverage added: - Negative message length (0x80000000) - Message length smaller than header (< 16 bytes) - Negative BSON document length (-1) - Zero BSON document length - Negative numberReturned in OP_REPLY - Excessively large numberReturned (0x3FFFFFFF) - Negative OP_MSG document sequence size - OP_MSG sequence size exceeding buffer - Valid OP_REPLY parsing (regression test) All tests use deferred recover() to catch any panics that would indicate the fixes are not working properly. --- How to Test cd packetbeat/protos/mongodb && go test -v ./... cd packetbeat/protos/mongodb && go test -race -v ./... cd packetbeat/protos/mongodb && go test -v -run TestMongodbParser_negativeMessageLength

nicholasberlin

Assuming my comments about int( are bogus, LGTM

packetbeat/protos/mongodb/mongodb_parser.go

nfritts

Any logging that can be triggered by "Every" packet should be Debug at the highest.

stanek-michal · 2025-12-08T14:12:15Z

Any logging that can be triggered by "Every" packet should be Debug at the highest.

good point, fixed.

* [Packetbeat] Fix bounds checking in MongoDB protocol parser Issues addressed: - Negative message length causing panic in truncate() - Negative BSON document length causing slice bounds panic - Negative or excessive numberReturned in OP_REPLY causing allocation panic - Negative document sequence size in OP_MSG causing integer overflow - Error handling gap in OP_QUERY where first readDocument error was lost * [Packetbeat] Add more MongoDB protocol parser tests Add tests verifying that malformed packets are properly rejected. Test coverage added: - Negative message length (0x80000000) - Message length smaller than header (< 16 bytes) - Negative BSON document length (-1) - Zero BSON document length - Negative numberReturned in OP_REPLY - Excessively large numberReturned (0x3FFFFFFF) - Negative OP_MSG document sequence size - OP_MSG sequence size exceeding buffer - Valid OP_REPLY parsing (regression test) All tests use deferred recover() to catch any panics that would indicate the fixes are not working properly. --- How to Test cd packetbeat/protos/mongodb && go test -v ./... cd packetbeat/protos/mongodb && go test -race -v ./... cd packetbeat/protos/mongodb && go test -v -run TestMongodbParser_negativeMessageLength * update changelog with packetbeat mongodb changes * Switch logging to debug on invalid packets * formatting * nolint for binary parsing (cherry picked from commit 306d2f4)

* [Packetbeat] Fix bounds checking in MongoDB protocol parser Issues addressed: - Negative message length causing panic in truncate() - Negative BSON document length causing slice bounds panic - Negative or excessive numberReturned in OP_REPLY causing allocation panic - Negative document sequence size in OP_MSG causing integer overflow - Error handling gap in OP_QUERY where first readDocument error was lost * [Packetbeat] Add more MongoDB protocol parser tests Add tests verifying that malformed packets are properly rejected. Test coverage added: - Negative message length (0x80000000) - Message length smaller than header (< 16 bytes) - Negative BSON document length (-1) - Zero BSON document length - Negative numberReturned in OP_REPLY - Excessively large numberReturned (0x3FFFFFFF) - Negative OP_MSG document sequence size - OP_MSG sequence size exceeding buffer - Valid OP_REPLY parsing (regression test) All tests use deferred recover() to catch any panics that would indicate the fixes are not working properly. --- How to Test cd packetbeat/protos/mongodb && go test -v ./... cd packetbeat/protos/mongodb && go test -race -v ./... cd packetbeat/protos/mongodb && go test -v -run TestMongodbParser_negativeMessageLength * update changelog with packetbeat mongodb changes * Switch logging to debug on invalid packets * formatting * nolint for binary parsing (cherry picked from commit 306d2f4) Co-authored-by: Michal Stanek <75310947+stanek-michal@users.noreply.github.com>

stanek-michal requested a review from a team as a code owner December 4, 2025 16:43

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Dec 4, 2025

mergify bot assigned stanek-michal Dec 4, 2025

stanek-michal added bug Team:Security-Linux Platform Linux Platform Team in Security Solution labels Dec 4, 2025

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Dec 4, 2025

stanek-michal added backport-8.19 Automated backport to the 8.19 branch backport-9.1 Automated backport to the 9.1 branch backport-9.2 Automated backport to the 9.2 branch labels Dec 4, 2025

stanek-michal added 3 commits December 4, 2025 17:47

update changelog with packetbeat mongodb changes

c48cda7

stanek-michal force-pushed the mongodb-parser-fixes branch from 5fc03b6 to c48cda7 Compare December 4, 2025 16:48

nicholasberlin approved these changes Dec 4, 2025

View reviewed changes

packetbeat/protos/mongodb/mongodb_parser.go Show resolved Hide resolved

packetbeat/protos/mongodb/mongodb_parser.go Show resolved Hide resolved

packetbeat/protos/mongodb/mongodb_parser.go Show resolved Hide resolved

nfritts requested changes Dec 8, 2025

View reviewed changes

Switch logging to debug on invalid packets

e95b6ea

nfritts approved these changes Dec 9, 2025

View reviewed changes

stanek-michal added 2 commits December 11, 2025 02:15

formatting

cd783cc

nolint for binary parsing

eb3f406

stanek-michal merged commit 306d2f4 into main Dec 15, 2025
47 checks passed

stanek-michal deleted the mongodb-parser-fixes branch December 15, 2025 16:50

This was referenced Dec 15, 2025

[8.19](backport #47925) [packetbeat] MongoDB parser fix bounds checks #48091

Merged

[9.1](backport #47925) [packetbeat] MongoDB parser fix bounds checks #48092

Merged

mergify bot mentioned this pull request Dec 15, 2025

[9.2](backport #47925) [packetbeat] MongoDB parser fix bounds checks #48093

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[packetbeat] MongoDB parser fix bounds checks#47925

[packetbeat] MongoDB parser fix bounds checks#47925
stanek-michal merged 6 commits intomainfrom
mongodb-parser-fixes

stanek-michal commented Dec 4, 2025 •

edited

Loading

github-actions bot commented Dec 4, 2025

mergify bot commented Dec 4, 2025

elasticmachine commented Dec 4, 2025

nicholasberlin left a comment

Uh oh!

Uh oh!

Uh oh!

nfritts left a comment

stanek-michal commented Dec 8, 2025

Uh oh!

Labels

4 participants

Conversation

stanek-michal commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

github-actions bot commented Dec 4, 2025

🤖 GitHub comments

mergify bot commented Dec 4, 2025

elasticmachine commented Dec 4, 2025

nicholasberlin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nfritts left a comment

Choose a reason for hiding this comment

stanek-michal commented Dec 8, 2025

Uh oh!

Labels

4 participants

stanek-michal commented Dec 4, 2025 •

edited

Loading