🛡️ Sentinel: Fix excessive stack usage in JSON escaping

[rgerhards]

🛡️ Sentinel: [MEDIUM] Fix excessive stack usage in JSON escaping

🚨 Severity: MEDIUM
💡 Vulnerability: jsonAddVal_escaped allocated 100KB on the stack, posing a DoS risk via stack overflow.
🎯 Impact: Crash/Denial of Service in deep call stacks or constrained environments.
🔧 Fix: Reduced stack buffer to 4KB; existing malloc fallback handles larger data.
✅ Verification: New regression test tests/json-long-string.sh confirms large strings are still processed correctly.

---

PR created automatically by Jules for task 3361815841138830520 started by @rgerhards

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Summary of Changes

Hello @rgerhards, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical vulnerability where a large stack allocation could lead to a Denial of Service. By significantly reducing the stack buffer size and relying on an existing heap allocation fallback for larger data, the system's stability is improved. A new test case has been added to ensure the fix functions as expected without introducing regressions for long string processing.

Highlights

• Vulnerability Fix: Reduced the stack buffer size in jsonAddVal_escaped from 100KB to 4KB to mitigate a potential Denial of Service (DoS) vulnerability caused by excessive stack usage during JSON escaping.
• Regression Testing: Introduced a new regression test, json-long-string.sh, to verify that JSON escaping correctly handles strings longer than the new 4KB stack buffer, ensuring the malloc fallback mechanism is properly engaged.
• Documentation: Added a new sentinel markdown file documenting the vulnerability, the lessons learned, and prevention strategies related to excessive stack allocation.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• .jules/sentinel.md
  • Added a new file documenting the excessive stack allocation vulnerability, its learning points, and prevention.
• runtime/msg.c
  • Reduced the wrkbuf stack buffer size from 100000 bytes to 4096 bytes within the jsonAddVal_escaped function.
• tests/Makefile.am
  • Included the new json-long-string.sh test script in the default test suite.
• tests/json-long-string.sh
  • Added a new test script to validate JSON escaping for strings exceeding the 4KB stack buffer, ensuring proper fallback to heap allocation.

Activity

• PR created automatically by Jules for task 3361815841138830520, initiated by @rgerhards.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request effectively addresses a denial-of-service vulnerability caused by excessive stack allocation. Reducing the buffer in jsonAddVal_escaped from 100KB to 4KB is a solid fix, especially since the function already has a fallback mechanism to heap allocation for larger data. The inclusion of a new regression test, tests/json-long-string.sh, is excellent as it ensures that the fix doesn't introduce regressions for large string processing. I have one minor suggestion to improve code maintainability.

[gemini-code-assist]

While 4096 is a much safer stack allocation size, it's good practice to define this value as a named constant (e.g., JSON_ESCAPE_STACK_BUF_SIZE) to improve readability and maintainability. This would make it clearer why this specific size was chosen and easier to modify in the future.

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tests/json-long-string.sh">

<violation number="1" location="tests/json-long-string.sh:36">
P2: Rule violated: **Code Quality Guard**

Ad-hoc validation with redundant checks violates testbench policy. Per `tests/AGENTS.md`: "Prefer harness helpers such as `cmp_exact`, `command_deny`, and `require_plugin` over ad-hoc shell to keep diagnostics uniform."

The `[ ! -f $RSYSLOG_OUT_LOG ]` check is entirely redundant with the `[ ! -s $RSYSLOG_OUT_LOG ]` check that follows (a file with size > 0 necessarily exists). Additionally, `$RSYSLOG_OUT_LOG` must be quoted in all shell expansions. This pattern of redundant guards with unquoted variables is a slop indicator (AI_PROBABILITY: high, POLICY_COMPLIANCE: low, SLOP_SCORE: elevated).</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Rule violated: Code Quality Guard

Ad-hoc validation with redundant checks violates testbench policy. Per tests/AGENTS.md: "Prefer harness helpers such as cmp_exact, command_deny, and require_plugin over ad-hoc shell to keep diagnostics uniform."

The [ ! -f $RSYSLOG_OUT_LOG ] check is entirely redundant with the [ ! -s $RSYSLOG_OUT_LOG ] check that follows (a file with size > 0 necessarily exists). Additionally, $RSYSLOG_OUT_LOG must be quoted in all shell expansions. This pattern of redundant guards with unquoted variables is a slop indicator (AI_PROBABILITY: high, POLICY_COMPLIANCE: low, SLOP_SCORE: elevated).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tests/json-long-string.sh, line 36:

<comment>Ad-hoc validation with redundant checks violates testbench policy. Per `tests/AGENTS.md`: "Prefer harness helpers such as `cmp_exact`, `command_deny`, and `require_plugin` over ad-hoc shell to keep diagnostics uniform."

The `[ ! -f $RSYSLOG_OUT_LOG ]` check is entirely redundant with the `[ ! -s $RSYSLOG_OUT_LOG ]` check that follows (a file with size > 0 necessarily exists). Additionally, `$RSYSLOG_OUT_LOG` must be quoted in all shell expansions. This pattern of redundant guards with unquoted variables is a slop indicator (AI_PROBABILITY: high, POLICY_COMPLIANCE: low, SLOP_SCORE: elevated).</comment>

<file context>
@@ -0,0 +1,57 @@
+shutdown_when_empty
+wait_shutdown
+
+if [ ! -f $RSYSLOG_OUT_LOG ]; then
+    error_exit 1
+fi
</file context>