Twenty-One Fields, Twenty Supplied — JavaScript Bug Hunt

Briefing

Modelled on the CrowdStrike Falcon outage (19 July 2024): a rapid-response content update carried fewer input fields than the sensor's template expected. The sensor read past the end of the supplied array, faulted in kernel mode, and around 8.5 million Windows machines blue-screened worldwide.

channel.js indexes fields straight out of the record with no count check.

Fix readTemplate so a record with the wrong field count is rejected before anything is read.

Bug report

BUG-CS0719 · Priority: Critical · Reported by: sensor team

readTemplate(record, template) must return { ok, values }:

• template.indexes lists the field positions the template needs
• if record.fields has fewer entries than the highest index requires, the record is invalid: return { ok: false, values: [] }
• otherwise return { ok: true, values: <the fields at those indexes> }

Observed: a record with 20 fields is fed to a template that reads index 20, and the read returns undefined — which downstream code dereferences.

Logs

[sensor] template 291 read index 20 of a 20-field record -> undefined
[sensor] PAGE_FAULT_IN_NONPAGED_AREA

The code as shipped

src/sensor/channel.js (editable)

// Extracts the fields a template needs from a channel record.
exports.readTemplate = function (record, template) {
  var values = [];
  for (var i = 0; i < template.indexes.length; i++) {
    values.push(record.fields[template.indexes[i]]);
  }
  return { ok: true, values: values };
};

Read-only context: src/sensor/FORMAT.js.