Catch stack overflow error in grok and regex pattern matching (#21290)

* catch stack overflow in grok * CL * catch stackoverflow in regex too --------- Co-authored-by: Maxwell <[email protected]>
Graylog2 · Jan 10, 2025 · 4c23be0 · 4c23be0
1 parent 75bf486
commit 4c23be0
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 7 deletions.
diff --git a/changelog/unreleased/issue-19975.toml b/changelog/unreleased/issue-19975.toml
@@ -0,0 +1,5 @@
+type = "f"
+message = "Catch and report exceptions during grok pattern matching."
+
+issues=["19975"]
+pulls = ["21290"]
diff --git a/...rver/src/main/java/org/graylog/plugins/pipelineprocessor/functions/strings/GrokMatch.java b/...rver/src/main/java/org/graylog/plugins/pipelineprocessor/functions/strings/GrokMatch.java
@@ -19,15 +19,14 @@
 import com.google.common.collect.ForwardingMap;
 import io.krakens.grok.api.Grok;
 import io.krakens.grok.api.Match;
+import jakarta.inject.Inject;
 import org.graylog.plugins.pipelineprocessor.EvaluationContext;
 import org.graylog.plugins.pipelineprocessor.ast.functions.AbstractFunction;
 import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionArgs;
 import org.graylog.plugins.pipelineprocessor.ast.functions.FunctionDescriptor;
 import org.graylog.plugins.pipelineprocessor.ast.functions.ParameterDescriptor;
 import org.graylog2.grok.GrokPatternRegistry;
 
-import jakarta.inject.Inject;
-
 import java.util.Map;
 
 import static com.google.common.collect.ImmutableList.of;
@@ -63,8 +62,12 @@ public GrokResult evaluate(FunctionArgs args, EvaluationContext context) {
 
         final Grok grok = grokPatternRegistry.cachedGrokForPattern(pattern, onlyNamedCaptures);
 
-        final Match match = grok.match(value);
-        return new GrokResult(match.captureFlattened());
+        try {
+            final Match match = grok.match(value);
+            return new GrokResult(match.captureFlattened());
+        } catch (StackOverflowError e) {
+            throw new IllegalStateException("Stack overflow during grok pattern matching");
+        }
     }
 
     @Override

diff --git a/...ver/src/main/java/org/graylog/plugins/pipelineprocessor/functions/strings/RegexMatch.java b/...ver/src/main/java/org/graylog/plugins/pipelineprocessor/functions/strings/RegexMatch.java
@@ -60,10 +60,14 @@ public RegexMatchResult evaluate(FunctionArgs args, EvaluationContext context) {
         final List<String> groupNames =
                 (List<String>) optionalGroupNames.optional(args, context).orElse(Collections.emptyList());
 
-        final Matcher matcher = regex.matcher(value);
-        final boolean matches = matcher.find();
+        try {
+            final Matcher matcher = regex.matcher(value);
+            final boolean matches = matcher.find();
 
-        return new RegexMatchResult(matches, matcher.toMatchResult(), groupNames);
+            return new RegexMatchResult(matches, matcher.toMatchResult(), groupNames);
+        } catch (StackOverflowError e) {
+            throw new IllegalStateException("Stack overflow during regex pattern matching");
+        }
 
     }