in_tail: fix out-of-bounds read in unesc_ends_with_nl

An empty docker log message reaches unesc_ends_with_nl with len 0, so flb_unescape_string returns 0 and unesc[unesc_len - 1] reads one byte before the heap buffer. Guard the index on unesc_len.

Signed-off-by: saddamr3e <saddamr3e@gmail.com>

Author: saddamr3e

plugins/in_tail/tail_dockermode.c

@@ -190,7 +190,7 @@ static int unesc_ends_with_nl(char *str, size_t len)
         return FLB_FALSE;
     }
     unesc_len = flb_unescape_string(str, len, &unesc);
-    nl = unesc[unesc_len - 1] == '\n';
+    nl = unesc_len > 0 && unesc[unesc_len - 1] == '\n';
     flb_free(unesc);
     return nl;
 }