Possible out-of-bounds Context read

[zhengyu123]

What does this PR do?:
Fixes an out-of-bounds read in Context::get_tag() (now bounds-checked getTag/setTag) that could be triggered by configuring more than DD_TAGS_CAPACITY (10) custom context attributes via the attributes= profiler argument.

• Context::tags is a fixed Tag[DD_TAGS_CAPACITY] array, but attributes= accepted an unbounded number of names and _num_context_attributes was set to that unbounded count with no cap.
• Recording::writeContextSnapshot() looped up to numContextAttributes() calling the unchecked get_tag(i), so configuring 11+ attributes read past the end of Context into adjacent memory on every datadog.HeapLiveObject event.
• Fix: Profiler::start() now caps args._context_attributes at DD_TAGS_CAPACITY (logging a warning when truncating) before it drives both the JFR metadata schema and _num_context_attributes, so the schema and the per-event write count always agree. Context::get_tag()/setTag() are replaced with encapsulated, bounds-checked getTag/setTag accessors (private tags[], shared isValidIndex() helper) as defense in depth for any future caller.

Motivation:
Security review flagged that attributes= had no upper bound on the number of configured names, while the native Context struct backing per-event tag storage is fixed-size. An out-of-bounds read on every liveness-tracking event can disclose adjacent native heap memory into the JFR recording, or crash the process (e.g. under ASan).

Additional Notes:
Iterated based on review feedback:

• Tighten API: replaced direct tags[] access with private storage + getTag/setTag.
• Fix: gave setTag a real runtime bounds check (not just a debug-only assert), matching getTag's existing clamp-to-default behavior.
• Dedup code: factored the repeated bounds condition out into a shared isValidIndex() helper used by both accessors.

How to test the change?:
Added ddprof-test/.../com/datadoghq/profiler/TooManyContextAttributesTest.java, which configures attributes= with 13 names (3 over capacity) together with liveness tracking (memory=...:L, the code path that exercises writeContextSnapshot/getTag), generates enough live allocation volume to produce datadog.HeapLiveObject samples, and asserts:

• the recording parses cleanly (would previously corrupt the JFR event stream or crash under ASan on the out-of-bounds read), and
• jdk.ActiveSetting reports exactly the first 10 attribute names, confirming the list is capped rather than the requested 13.

For Datadog employees:

• If this PR touches code that signs or publishes builds or packages, or handles
  credentials of any kind, I've requested a security review (run the dd:platform-security-review
  skill, or file a request via the PSEC review form).
  bewaire also runs automatically on every PR.
• This PR doesn't touch any of that.
• JIRA: PROF-15847

Unsure? Have a question? Request a review!

[dd-octo-sts]

Scan-Build Report

User:	runner@runnervmlun5p
Working Directory:	/home/runner/work/java-profiler/java-profiler/ddprof-lib/src/test/make
Command Line:	make -j4 all
Clang Version:	Ubuntu clang version 18.1.3 (1ubuntu1)
Date:	Mon Sep 14 17:27:10 2026

Bug Summary

Bug Type	Quantity	Display?
All Bugs	1
Logic error
Dereference of null pointer	1

Reports

Bug Group	Bug Type ▾	File	Function/Method	Line	Path Length
Logic error	Dereference of null pointer	faultInjection.cpp	crashNow	24	2

[dd-octo-sts]

CI Test Results

Run: #36587044441 | Commit: 99028ed | Duration: 15m 28s (longest job)

✅ All 32 test jobs passed

Status Overview

JDK	glibc-aarch64/debug	glibc-amd64/debug	musl-aarch64/debug	musl-amd64/debug
8	-	✅	-	-
8-ibm	-	✅	-	-
8-j9	✅	✅	-	-
8-librca	-	-	✅	✅
8-orcl	-	✅	-	-
11	-	✅	-	-
11-j9	✅	✅	-	-
11-librca	-	-	✅	✅
17	✅	✅	-	-
17-graal	✅	✅	-	-
17-j9	✅	✅	-	-
17-librca	-	-	✅	✅
21	✅	✅	-	-
21-graal	✅	✅	-	-
21-librca	-	-	✅	✅
25	✅	✅	-	-
25-graal	✅	✅	-	-
25-librca	-	-	✅	✅

Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled

Summary: Total: 32 | Passed: 32 | Failed: 0

---

Updated: 2026-09-29 15:48:05 UTC

[dd-octo-sts]

✅ All 36 integration tests passed

📊 Dashboard · 👷 Pipeline · 📦 c53020f1

[datadog-datadog-us1-prod]

More details

The 10-attribute cap keeps the JFR schema and event field count within Context storage. The checked accessors also reject invalid tag indexes.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit fdfffbe · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[jbachorik]

LGTM!

[rkennke]

Automated sphinx review — spot-check findings below, none HIGH/CRITICAL.

[datadog-datadog-us1-prod]

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 4 Pipeline jobs failed

DataDog/java-profiler | gtest-asan-amd64

View more details · View in GitLab

DataDog/java-profiler | gtest-asan-arm64

View more details · View in GitLab

DataDog/java-profiler | gtest-tsan-amd64

View more details · View in GitLab

View all 4 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 751c236 | Docs | View more details | Give us feedback!}