aquasecurity · geyslan · Aug 23, 2024 · Jul 18, 2024
diff --git a/pkg/bufferdecoder/eventsreader.go b/pkg/bufferdecoder/eventsreader.go
@@ -1,7 +1,6 @@
 package bufferdecoder
 
 import (
-	"bytes"
 	"encoding/binary"
 	"net"
 	"strconv"
@@ -373,21 +372,29 @@ func readStringFromBuff(ebpfMsgDecoder *EbpfDecoder) (string, error) {
 func readStringVarFromBuff(decoder *EbpfDecoder, max int) (string, error) {
 	var err error
 	var char int8
-	res := make([]byte, max)
+	res := make([]byte, 0, max)
+
 	err = decoder.DecodeInt8(&char)
 	if err != nil {
 		return "", errfmt.Errorf("error reading null terminated string: %v", err)
 	}
-	var count int
-	for count = 1; char != 0 && count < max; count++ {
+
+	count := 1 // first char is already decoded
+	for char != 0 && count < max {
 		res = append(res, byte(char))
+
+		// decode next char
 		err = decoder.DecodeInt8(&char)
 		if err != nil {
 			return "", errfmt.Errorf("error reading null terminated string: %v", err)
 		}
+		count++
 	}
-	res = bytes.TrimLeft(res[:], "\000")
-	decoder.cursor += max - count // move cursor to end of buffer
+
+	// The exact reason for this Trim is not known, so remove it for now,
+	// since it increases processing time.
+	// res = bytes.TrimLeft(res[:], "\000")
+	decoder.cursor += max - count // move cursor to the end of the buffer
 	return string(res), nil
 }
 

diff --git a/pkg/bufferdecoder/eventsreader_bench_test.go b/pkg/bufferdecoder/eventsreader_bench_test.go
@@ -0,0 +1,56 @@
+package bufferdecoder
+
+import (
+	"bytes"
+	"testing"
+)
+
+func BenchmarkReadStringVarFromBuff_ShortString(b *testing.B) {
+	buffer := []byte{'H', 'e', 'l', 'l', 'o', 0}
+	max := 10
+	var str string
+
+	for i := 0; i < b.N; i++ {
+		decoder := New(buffer)
+		str, _ = readStringVarFromBuff(decoder, max)
+	}
+	_ = str
+}
+
+func BenchmarkReadStringVarFromBuff_MediumString(b *testing.B) {
+	buffer := []byte{'T', 'h', 'i', 's', ' ', 'i', 's', ' ', 'a', ' ', 't', 'e', 's', 't', 0}
+	max := 20
+	var str string
+
+	for i := 0; i < b.N; i++ {
+		decoder := New(buffer)
+		str, _ = readStringVarFromBuff(decoder, max)
+	}
+	_ = str
+}
+
+func BenchmarkReadStringVarFromBuff_LongString(b *testing.B) {
+	buffer := append(bytes.Repeat([]byte{'A'}, 10000), 0)
+	max := 10000
+	var str string
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		decoder := New(buffer)
+		str, _ = readStringVarFromBuff(decoder, max)
+	}
+	_ = str
+}
+
+func BenchmarkReadStringVarFromBuff_LongStringLowMax(b *testing.B) {
+	buffer := bytes.Repeat([]byte{'A'}, 10000)
+	max := 100
+	var str string
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		decoder := New(buffer)
+		str, _ = readStringVarFromBuff(decoder, max)
+	}
+	_ = str
+}
diff --git a/pkg/bufferdecoder/eventsreader_test.go b/pkg/bufferdecoder/eventsreader_test.go
@@ -188,6 +188,88 @@ func TestReadArgFromBuff(t *testing.T) {
 	}
 }
 
+func TestReadStringVarFromBuff(t *testing.T) {
+	tests := []struct {
+		name           string
+		buffer         []byte
+		max            int
+		expected       string
+		expectedCursor int
+		expectError    bool
+	}{
+		{
+			name:           "Null terminated string in larger buffer",
+			buffer:         []byte{'H', 'e', 'l', 'l', 'o', 0, 'W', 'o', 'r', 'l', 'd'},
+			max:            6,
+			expected:       "Hello",
+			expectedCursor: 6,
+			expectError:    false,
+		},
+		{
+			name:           "Buffer with same length as max without null terminator",
+			buffer:         []byte{'H', 'e', 'l', 'l', 'o'},
+			max:            5,
+			expected:       "Hell",
+			expectedCursor: 5,
+			expectError:    false,
+		},
+		{
+			name:           "Buffer longer than max length without null terminator",
+			buffer:         []byte{'H', 'e', 'l', 'l', 'o', 'W', 'o', 'r', 'l', 'd'},
+			max:            5,
+			expected:       "Hell",
+			expectedCursor: 5,
+			expectError:    false,
+		},
+		{
+			name:           "Zero max length",
+			buffer:         []byte{'H', 'e', 'l', 'l', 'o', 0, 'W', 'o', 'r', 'l', 'd'},
+			max:            0,
+			expected:       "",
+			expectedCursor: 0,
+			expectError:    false,
+		},
+		{
+			name:           "Buffer started with null terminator",
+			buffer:         []byte{0, 'N', 'u', 'l', 'l', 0, 'W', 'o', 'r', 'l', 'd'},
+			max:            6,
+			expected:       "",
+			expectedCursor: 6,
+			expectError:    false,
+		},
+		{
+			name:           "Empty buffer",
+			buffer:         []byte{},
+			max:            5,
+			expected:       "",
+			expectedCursor: 0,
+			expectError:    true,
+		},
+		{
+			name:           "Buffer too short",
+			buffer:         []byte{'H'},
+			max:            5,
+			expected:       "H",
+			expectedCursor: 0,
+			expectError:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			decoder := New(tt.buffer)
+			actual, err := readStringVarFromBuff(decoder, tt.max)
+			if tt.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.expected, actual)
+				assert.Equal(t, tt.expectedCursor, decoder.ReadAmountBytes())
+			}
+		})
+	}
+}
+
 func TestPrintUint32IP(t *testing.T) {
 	t.Parallel()