Fix a crash related to ElfParser::loadSymbolTable (#191) #192
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jbachorik
approved these changes
Mar 11, 2025
|
Thank you for your review. |
svc-squareup-copybara
pushed a commit
to cashapp/misk
that referenced
this pull request
Apr 11, 2025
| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | org.flywaydb.flyway | plugin | misk/gradle/libs.versions.toml | gradle | minor | `11.6.0` -> `11.7.0` | | [com.squareup.okio:okio-fakefilesystem](https://github.com/square/okio) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `3.10.2` -> `3.11.0` | | [com.squareup.okio:okio](https://github.com/square/okio) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `3.10.2` -> `3.11.0` | | [com.autonomousapps.dependency-analysis](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin) | plugin | misk/gradle/libs.versions.toml | gradle | minor | `2.15.0` -> `2.16.0` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.47.3` -> `1.48.1` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.47.3` -> `1.48.1` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | --- ### Release Notes <details> <summary>square/okio (com.squareup.okio:okio-fakefilesystem)</summary> ### [`v3.11.0`](https://github.com/square/okio/blob/HEAD/CHANGELOG.md#Version-3110) *2025-04-09* - Fix: Clear the deflater's byte array reference - New: Faster implementation of `String.decodeHex()` on Kotlin/JS. - New: Declare `EXACTLY_ONCE` execution for blocks like `Closeable.use {}` and `FileSystem.read {}`. - Upgrade: \[Kotlin 2.1.20]\[kotlin\_2\_1\_20]. </details> <details> <summary>autonomousapps/dependency-analysis-android-gradle-plugin (com.autonomousapps.dependency-analysis)</summary> ### [`v2.16.0`](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin/blob/HEAD/CHANGELOG.md#Version-2160) - \[Feat]: support `com.android.test` projects. - \[Feat]: support typesafe project accessors with opt-in. ```kotlin dependencyAnalysis { useTypesafeProjectAccessors(true) // false by default } ``` </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.48.1`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.48.1): 1.48.1 ### Components #### Tracer internal logging - 🐛 Remove print line causing unnecessary logs ([#​8687](DataDog/dd-trace-java#8687) - [@​sarahchen6](https://github.com/sarahchen6)) ### [`v1.48.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.48.0): 1.48.0 ### Known Bugs > \[!NOTE] > If you are experiencing issues with spamming timeout logs, please update to the [latest version](https://github.com/DataDog/dd-trace-java/releases/latest) or set [JDK_SOCKET_ENABLED](https://github.com/DataDog/dd-trace-java/blob/33fc3c9a9b7cda3beda88b8b3e5224ae2b10764a/dd-trace-api/src/main/java/datadog/trace/api/config/GeneralConfig.java#L98) to false. ### Components #### Application Security Management (IAST) - ✨ Fix vulnerability location org.jose4j.lang.HashUtil ([#​8610](DataDog/dd-trace-java#8610) - [@​jandro996](https://github.com/jandro996)) - ✨ Fix weak randomness in oracle.ucp.util.OpaqueString ([#​8609](DataDog/dd-trace-java#8609) - [@​jandro996](https://github.com/jandro996)) - ✨ Fix weak hash false positive in oracle.security.o5logon.O5Logon ([#​8608](DataDog/dd-trace-java#8608) - [@​jandro996](https://github.com/jandro996)) - 🐛 Prevent before callsites targeting constructors in super calls ([#​8549](DataDog/dd-trace-java#8549) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Application Security Management (WAF) - ✨ Update login events public SDK to V2 ([#​8620](DataDog/dd-trace-java#8620) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Send RASP LFI capability only when AppSec is statically enabled ([#​8573](DataDog/dd-trace-java#8573) - [@​jandro996](https://github.com/jandro996)) - ✨ Improve detection of missing request end events ([#​8510](DataDog/dd-trace-java#8510) - [@​smola](https://github.com/smola)) - 🧹 Remove remote configuration for API Security sampling rate ([#​8486](DataDog/dd-trace-java#8486) - [@​smola](https://github.com/smola)) - ✨ Add setUser to user monitoring SDK ([#​8482](DataDog/dd-trace-java#8482) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add missing address for signup event ([#​8469](DataDog/dd-trace-java#8469) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Allow login events SDK to be used with appsec disabled ([#​8464](DataDog/dd-trace-java#8464) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add support for endpoint discovery in spring mvc ([#​8352](DataDog/dd-trace-java#8352) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ New API Security sampling algorithm ([#​8178](DataDog/dd-trace-java#8178) - [@​ValentinZakharov](https://github.com/ValentinZakharov)) #### Build & Tooling - ✨ Add buffer size customizability to JDK UDS support ([#​8629](DataDog/dd-trace-java#8629) - [@​sarahchen6](https://github.com/sarahchen6)) - ✨ Add JDK built-in support for UDS on Java 16+ ([#​8314](DataDog/dd-trace-java#8314) - [@​sarahchen6](https://github.com/sarahchen6)) #### Configuration at Runtime - 🐛 Send RASP LFI capability only when AppSec is statically enabled ([#​8573](DataDog/dd-trace-java#8573) - [@​jandro996](https://github.com/jandro996)) #### Continuous Integration Visibility - 🐛 Prevent double reporting of Scalatest events when using SBT with test forking ([#​8682](DataDog/dd-trace-java#8682) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Shutdown CI Visibility test event handlers before tracer ([#​8677](DataDog/dd-trace-java#8677) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Do not apply JUnit 4 instrumentation to MUnit runners ([#​8675](DataDog/dd-trace-java#8675), [#​8683](DataDog/dd-trace-java#8683) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Remove error log when source path resolution fails on isModified check ([#​8663](DataDog/dd-trace-java#8663) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement tests reordering for JUnit 4 ([#​8650](DataDog/dd-trace-java#8650) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - 🐛 Set default Attempt to Fix retries if none provided from the backend ([#​8615](DataDog/dd-trace-java#8615) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Allow to manually set PR info ([#​8566](DataDog/dd-trace-java#8566) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix Test Optimization init when repo root cannot be determined ([#​8533](DataDog/dd-trace-java#8533) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add capabilities tagging ([#​8499](DataDog/dd-trace-java#8499), [#​8540](DataDog/dd-trace-java#8540) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) #### Crash tracking - 🐛 Remove dependency on bash from crash/oome uploder scripts ([#​8652](DataDog/dd-trace-java#8652) - [@​jbachorik](https://github.com/jbachorik)) #### Data Streams Monitoring - ✨ e2e pipeline configuration when data jobs is enabled ([#​8553](DataDog/dd-trace-java#8553) - [@​kr-igor](https://github.com/kr-igor)) #### Dynamic Instrumentation - 🐛 Fix In-Product when config is empty ([#​8679](DataDog/dd-trace-java#8679) - [@​jpbempel](https://github.com/jpbempel)) - ✨ Add support for filtering shaded third-party libs ([#​8612](DataDog/dd-trace-java#8612) - [@​jpbempel](https://github.com/jpbempel)) - ✨ Add In-Product Enablement ([#​8587](DataDog/dd-trace-java#8587) - [@​jpbempel](https://github.com/jpbempel)) - ✨⚡ Reduce footprint of SourceFile tracking ([#​8524](DataDog/dd-trace-java#8524) - [@​jpbempel](https://github.com/jpbempel)) - ✨⚡ Optimize the SourceFile tracking ([#​8520](DataDog/dd-trace-java#8520) - [@​jpbempel](https://github.com/jpbempel)) #### OpenTracing - 🧹 Remove activeScope() use in OpenTracing shim ([#​8478](DataDog/dd-trace-java#8478) - [@​mcculls](https://github.com/mcculls)) #### Profiling - ✨ Add profiler env check command to AgentCLI ([#​8671](DataDog/dd-trace-java#8671) - [@​jbachorik](https://github.com/jbachorik)) - ✨ Bump ddprof to 1.23.0 ([#​8668](DataDog/dd-trace-java#8668) - [@​jbachorik](https://github.com/jbachorik)) - Fix a crash related to ElfParser::loadSymbolTable ([#​191](DataDog/dd-trace-java#191)) by [@​yanglong1010](https://github.com/yanglong1010) in DataDog/java-profiler#192 - Unwind String.indexOf intrinsic on AArch64 by [@​MattAlp](https://github.com/MattAlp) in DataDog/java-profiler#193 - Fix Java 24 support by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#194 - A set of fixes related to clang, aarch64 and musl pecularities of vmstructs stack unwinder by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#199 - 🐛 Remove process information from JFR recording ([#​8661](DataDog/dd-trace-java#8661) - [@​r1viollet](https://github.com/r1viollet)) - 🐛 Make TempLocationManager USER aware ([#​8605](DataDog/dd-trace-java#8605) - [@​jbachorik](https://github.com/jbachorik)) - ✨ Extract git tags from embedded git.properties and datadog_git.properties ([#​8561](DataDog/dd-trace-java#8561) - [@​wmouchere](https://github.com/wmouchere)) #### Telemetry - 🐛 Fix appsec.rasp.error and appsec.waf.error telemetry metrics ([#​8624](DataDog/dd-trace-java#8624) - [@​jandro996](https://github.com/jandro996)) - ✨ Create metric: appsec.rasp.rule.skipped ([#​8618](DataDog/dd-trace-java#8618) - [@​jandro996](https://github.com/jandro996)) - ✨ Extract git tags from embedded git.properties and datadog_git.properties ([#​8561](DataDog/dd-trace-java#8561) - [@​wmouchere](https://github.com/wmouchere)) #### Testing - 🧹 Simplify ssi tests one-pipeline ([#​8558](DataDog/dd-trace-java#8558) - [@​robertomonteromiguel](https://github.com/robertomonteromiguel)) - ✨ Add smoke tests for java's concurrent API ([#​8438](DataDog/dd-trace-java#8438) - [@​sarahchen6](https://github.com/sarahchen6)) #### Trace context propagation - ✨ Adding Support for `TRACE_PROPAGATION_BEHAVIOR_EXTRACT` ([#​8535](DataDog/dd-trace-java#8535) - [@​mhlidd](https://github.com/mhlidd)) #### Tracer core - 🐛 Ensure shaded helpers have unique names ([#​8559](DataDog/dd-trace-java#8559) - [@​amarziali](https://github.com/amarziali)) - ✨ Support common config sources for user-provided git info ([#​8547](DataDog/dd-trace-java#8547) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Make the default config sources more robust when a security manager is installed ([#​8544](DataDog/dd-trace-java#8544) - [@​mcculls](https://github.com/mcculls)) - ✨ Support targeting services with configurations in stable configuration file ([#​8526](DataDog/dd-trace-java#8526) - [@​mtoffl01](https://github.com/mtoffl01)) - ✨ Add new parser for `DD_TAGS` and prioritizing `DD_SERVICE` ([#​8296](DataDog/dd-trace-java#8296) - [@​mhlidd](https://github.com/mhlidd)) #### Tracer internal logging - 🐛 Add missing debug log for the cloudPayloadTaggingServices config ([#​8600](DataDog/dd-trace-java#8600) - [@​ygree](https://github.com/ygree)) - ✨ Add the possibility to output the logs of the Java tracer in JSON ([#​8083](DataDog/dd-trace-java#8083) - [@​cecile75](https://github.com/cecile75)) #### Tracer public API - ✨ Introducing `DD_TRACE_EXPERIMENTAL_FEATURES_ENABLED` Config ([#​8536](DataDog/dd-trace-java#8536) - [@​mhlidd](https://github.com/mhlidd)) - ✨ Config Consistency Round 2 ([#​8489](DataDog/dd-trace-java#8489) - [@​mhlidd](https://github.com/mhlidd)) ### Instrumentations #### - 🐛 Fix NPE in getMdcCopy of LoggingEventInstrumentation ([#​8599](DataDog/dd-trace-java#8599) - [@​ygree](https://github.com/ygree)) #### Apache Spark instrumentation - ✨ Instrument Runtime.exit() to finish spark application spans ([#​8572](DataDog/dd-trace-java#8572) - [@​paul-laffon-dd](https://github.com/paul-laffon-dd)) - ✨ Configure OpenLineage if present in Spark instrumentation ([#​8541](DataDog/dd-trace-java#8541) - [@​mobuchowski](https://github.com/mobuchowski)) #### Armeria Instrumentation - ✨ Support armeria grpc 1.32.3 ([#​8606](DataDog/dd-trace-java#8606) - [@​github-actions](https://github.com/github-actions)\[bot]) #### AWS DynamoDB Instrumentation - ✨ Create DynamoDB instrumentation + add span pointers for `updateItem` and `deleteItem` ([#​8490](DataDog/dd-trace-java#8490) - [@​nhulston](https://github.com/nhulston)) #### AWS SDK instrumentation - ✨ Add DynamoDB in DEFAULT_TRACE_CLOUD_PAYLOAD_TAGGING_SERVICES ([#​8595](DataDog/dd-trace-java#8595) - [@​joeyzhao2018](https://github.com/joeyzhao2018)) #### Azure Functions instrumentation - ✨ Enable tracer computed trace metrics by default for Azure Functions ([#​8518](DataDog/dd-trace-java#8518) - [@​duncanpharvey](https://github.com/duncanpharvey)) - 💡 Add azure-functions instrumentation ([#​8432](DataDog/dd-trace-java#8432) - [@​duncanpharvey](https://github.com/duncanpharvey)) #### Core Java language instrumentation - 🐛 Fix ForkJoinPool.execute() instrumentation on Java 21+ ([#​8560](DataDog/dd-trace-java#8560) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) #### Eclipse Vert.x instrumentation - ✨ Add vertx postgresql client instrumentation ([#​8471](DataDog/dd-trace-java#8471) - [@​vandonr](https://github.com/vandonr) - thanks for the contribution!) #### Kafka instrumentation - ✨ Support and test kafka-clients 4 ([#​8581](DataDog/dd-trace-java#8581) - [@​amarziali](https://github.com/amarziali)) #### Kotlin instrumentation - ✨ Avoid disconnected traces when using Kotlin flowOn ([#​8651](DataDog/dd-trace-java#8651) - [@​mcculls](https://github.com/mcculls)) #### OpenTelemetry instrumentation - 🧹 Migrate OtelContext wrapper to new internal Context API ([#​8645](DataDog/dd-trace-java#8645) - [@​mcculls](https://github.com/mcculls)) #### Spring instrumentation - 🐛 Support CompletableFuture on spring webmvc controllers ([#​8659](DataDog/dd-trace-java#8659) - [@​amarziali](https://github.com/amarziali)) - ✨ Add support for endpoint discovery in spring mvc ([#​8352](DataDog/dd-trace-java#8352) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### WebSocket Instrumentation - ✨ Instrument Jetty websocket pojo ([#​8562](DataDog/dd-trace-java#8562) - [@​amarziali](https://github.com/amarziali)) - 💡 Instrument Java Websocket API (JSR356) ([#​8440](DataDog/dd-trace-java#8440) - [@​amarziali](https://github.com/amarziali)) #### All other instrumentations - ✨ Introduce cache for peer.hostname lookup ([#​8601](DataDog/dd-trace-java#8601) - [@​mcculls](https://github.com/mcculls)) - ✨ Support pekko http 1.1 ([#​8532](DataDog/dd-trace-java#8532) - [@​amarziali](https://github.com/amarziali)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 331314f71acaced3adc75ea5d7e855c248d593fc
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?:
Revert code in ElfParser::loadSymbolTable to fix a possible crash
Motivation:
I encountered the crash last week, after discussion in #191, it's acceptable to revert the code
Additional Notes:
How to test the change?:
gradle assembleReleaseJaris successfulFor Datadog employees:
credentials of any kind, I've requested a review from
@DataDog/security-design-and-guidance.I would be very grateful if you could review this PR !