Skip to content
Merged
25 changes: 25 additions & 0 deletions .chloggen/xpdata-mapbuilder.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# Use this changelog template to create an entry for release notes.

# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
change_type: 'enhancement'

# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
component: xpdata

# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
note: Add experimental MapBuilder struct to optimize pcommon.Map construction

# One or more tracking issues or pull requests related to the change
issues: [13617]

# (Optional) One or more lines of additional information to render under the primary note.
# These lines will be padded with 2 spaces and then inserted directly into the document.
# Use pipe (|) for multiline entries.
subtext:

# Optional: The change log or logs in which this entry should be included.
# e.g. '[user]' or '[user, api]'
# Include 'user' if the change is relevant to end users.
# Include 'api' if there is a change to a library API.
# Default: '[user]'
change_logs: [api]
55 changes: 55 additions & 0 deletions pdata/xpdata/map_builder.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
// Copyright The OpenTelemetry Authors
// SPDX-License-Identifier: Apache-2.0

package xpdata // import "go.opentelemetry.io/collector/pdata/xpdata"

import (
"go.opentelemetry.io/collector/pdata/internal"
otlpcommon "go.opentelemetry.io/collector/pdata/internal/data/protogen/common/v1"
"go.opentelemetry.io/collector/pdata/pcommon"
)

// MapBuilder is an experimental struct which can be used to create a pcommon.Map more efficiently
// than by repeated use of the Put family of methods, which check for duplicate keys on every call
// (a linear time operation).
// A zero-initialized MapBuilder is ready for use.
type MapBuilder struct {
state internal.State
pairs []otlpcommon.KeyValue
}

// EnsureCapacity increases the capacity of this MapBuilder instance, if necessary,
// to ensure that it can hold at least the number of elements specified by the capacity argument.
func (mb *MapBuilder) EnsureCapacity(capacity int) {
mb.state.AssertMutable()
oldValues := mb.pairs
if capacity <= cap(oldValues) {
return
}
mb.pairs = make([]otlpcommon.KeyValue, len(oldValues), capacity)
copy(mb.pairs, oldValues)
}

func (mb *MapBuilder) getValue(i int) pcommon.Value {
return pcommon.Value(internal.NewValue(&mb.pairs[i].Value, &mb.state))
}

// AppendEmpty appends a key/value pair to the MapBuilder and return the inserted value.
// This method does not check for duplicate keys and has an amortized constant time complexity.
func (mb *MapBuilder) AppendEmpty(k string) pcommon.Value {
mb.state.AssertMutable()
mb.pairs = append(mb.pairs, otlpcommon.KeyValue{Key: k})
return mb.getValue(len(mb.pairs) - 1)
}

// UnsafeIntoMap transfers the contents of a MapBuilder into a Map, without checking for duplicate keys.
// If the MapBuilder contains duplicate keys, the behavior of the resulting Map is unspecified;
// consider using DistinctIntoMap if you are unsure or performance is not a concern.
// This operation has constant time complexity and makes no allocations.
// After this operation, the MapBuilder becomes read-only.
func (mb *MapBuilder) UnsafeIntoMap(m pcommon.Map) {
mb.state.AssertMutable()
internal.GetMapState(internal.Map(m)).AssertMutable()
mb.state = internal.StateReadOnly // to avoid modifying a Map later marked as ReadOnly through builder Values
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the purpose of this map if it is ReadOnly?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alternative is to "move" the values into the returned Map, so then the builder becomes empty and the Map will be mutable.

Copy link
Contributor Author

@jade-guiton-dd jade-guiton-dd Aug 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Values returned by AppendEmpty use the state of the MapBuilder. But the Map we return has its own state, which may later be changed to ReadOnly. So to avoid indirectly modifying a ReadOnly Map through a Value returned by the MapBuilder, we mark the MapBuilder itself as ReadOnly once we're done with it. But we don't modify the state of the Map, it stays mutable through this function.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After thinking about it some more, I'm pretty sure that even with these precautions it's still possible to bypass read-only protections.

"Exploit" details
  1. create a MapBuilder
  2. use AppendEmpty to get a mutable Value
  3. use UnsafeIntoMap to transfer into a Map; this makes your Value read-only
  4. resulting Map is later marked as read-only as well using ptrace.Traces.MarkReadOnly() or equivalents for other signals
  5. overwrite the MapBuilder in-place with a zero-initialized one to reset its state; your Value is now mutable again, and points into the read-only Map.

But I noticed that the Map.MoveTo method doesn't handle that edge case either: even if the target Map is later marked as read-only, you can still modify its entries using Values previously obtained from the source Map.

So I won't bother trying to bullet-proof it and just do what you suggested, ie. UnsafeIntoMap will make the builder empty, but it won't turn it ReadOnly.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is consider UB (and may crash) to modify references after data are passed to the next component because we don't have any mutexes, etc. So I think you are worried about something that is prohibited.

*internal.GetOrigMap(internal.Map(m)) = mb.pairs
}
36 changes: 36 additions & 0 deletions pdata/xpdata/map_builder_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
// Copyright The OpenTelemetry Authors
// SPDX-License-Identifier: Apache-2.0

package xpdata_test

import (
"testing"

"github.com/stretchr/testify/assert"

"go.opentelemetry.io/collector/pdata/pcommon"
"go.opentelemetry.io/collector/pdata/xpdata"
)

func TestMapBuilder(t *testing.T) {
var mb xpdata.MapBuilder
mb.EnsureCapacity(3)
mb.AppendEmpty("key1").SetStr("val")
mb.AppendEmpty("key2").SetInt(42)

m := pcommon.NewMap()
mb.UnsafeIntoMap(m)

assert.Equal(t, 2, m.Len())
val, ok := m.Get("key1")
assert.True(t, ok && val.Type() == pcommon.ValueTypeStr && val.Str() == "val")
val, ok = m.Get("key2")
assert.True(t, ok && val.Type() == pcommon.ValueTypeInt && val.Int() == 42)

assert.Panics(t, func() {
mb.AppendEmpty("key3") // mb should now be read-only
})
assert.NotPanics(t, func() {
m.PutEmpty("key3") // m should still be mutable
})
}
Loading