Uploaded image for project: 'Java Driver'
  1. Java Driver
  2. JAVA-2179

com.mongodb.connection.ByteBufferBsonOutput generated negative buffer size by integer overflow

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 0.8
    • Affects Version/s: 3.2.2
    • Component/s: BSON
    • Labels:
      None

      In the class com.mongodb.connection.ByteBufferBsonOutput there is some strange buffer size calculation algorithm:

      bufferList.add(bufferProvider.getBuffer(Math.min(INITIAL_BUFFER_SIZE << index, MAX_BUFFER_SIZE)));

      for index=21 the part INITIAL_BUFFER_SIZE << index creates an *integer overflow*, resulting in the negative value: -2147483648
      This causes the overall buffer size calculated in the presented line to become negative which will cause in the end the following exception:

      {{java.lang.IllegalArgumentException: null
      at java.nio.ByteBuffer.allocate(ByteBuffer.java:334) ~
      at com.mongodb.internal.connection.PowerOfTwoBufferPool.createNew(PowerOfTwoBufferPool.java:84) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.internal.connection.PowerOfTwoBufferPool.getBuffer(PowerOfTwoBufferPool.java:76) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.SocketStream.getBuffer(SocketStream.java:69) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.InternalStreamConnection.getBuffer(InternalStreamConnection.java:511) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.UsageTrackingInternalConnection.getBuffer(UsageTrackingInternalConnection.java:89) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.DefaultConnectionPool$PooledConnection.getBuffer(DefaultConnectionPool.java:417) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.ByteBufferBsonOutput.getByteBufferAtIndex(ByteBufferBsonOutput.java:89) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.ByteBufferBsonOutput.getCurrentByteBuffer(ByteBufferBsonOutput.java:84) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.ByteBufferBsonOutput.writeByte(ByteBufferBsonOutput.java:73) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.io.OutputBuffer.write(OutputBuffer.java:150) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.io.OutputBuffer.writeInt32(OutputBuffer.java:59) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.io.OutputBuffer.writeInt(OutputBuffer.java:160) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.io.OutputBuffer.writeString(OutputBuffer.java:89) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.BsonBinaryWriter.doWriteString(BsonBinaryWriter.java:262) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.AbstractBsonWriter.writeString(AbstractBsonWriter.java:548) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.codecs.StringCodec.encode(StringCodec.java:31) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.codecs.StringCodec.encode(StringCodec.java:28) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBObjectCodec.writeValue(DBObjectCodec.java:211) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBObjectCodec.encodeMap(DBObjectCodec.java:220) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBObjectCodec.writeValue(DBObjectCodec.java:196) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBObjectCodec.encodeIterable(DBObjectCodec.java:269) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBObjectCodec.writeValue(DBObjectCodec.java:198) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBObjectCodec.encode(DBObjectCodec.java:128) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBObjectCodec.encode(DBObjectCodec.java:61) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.CompoundDBObjectCodec.encode(CompoundDBObjectCodec.java:48) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.CompoundDBObjectCodec.encode(CompoundDBObjectCodec.java:27) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.codecs.BsonDocumentWrapperCodec.encode(BsonDocumentWrapperCodec.java:63) ~[mongo-java-driver-3.2.2.jar:na]
      at org.bson.codecs.BsonDocumentWrapperCodec.encode(BsonDocumentWrapperCodec.java:29) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.InsertCommandMessage.writeTheWrites(InsertCommandMessage.java:101) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.InsertCommandMessage.writeTheWrites(InsertCommandMessage.java:43) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.BaseWriteCommandMessage.encodeMessageBodyWithMetadata(BaseWriteCommandMessage.java:129) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.RequestMessage.encodeWithMetadata(RequestMessage.java:160) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.WriteCommandProtocol.sendMessage(WriteCommandProtocol.java:212) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.WriteCommandProtocol.execute(WriteCommandProtocol.java:101) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.InsertCommandProtocol.execute(InsertCommandProtocol.java:67) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.InsertCommandProtocol.execute(InsertCommandProtocol.java:37) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.DefaultServer$DefaultServerProtocolExecutor.execute(DefaultServer.java:159) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.DefaultServerConnection.executeProtocol(DefaultServerConnection.java:286) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.connection.DefaultServerConnection.insertCommand(DefaultServerConnection.java:115) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.operation.InsertOperation.executeCommandProtocol(InsertOperation.java:76) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:141) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:133) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.operation.OperationHelper.withConnectionSource(OperationHelper.java:230) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.operation.OperationHelper.withConnection(OperationHelper.java:221) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:133) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:60) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.Mongo.execute(Mongo.java:781) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.Mongo$2.execute(Mongo.java:764) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBCollection.executeWriteOperation(DBCollection.java:333) ~[mongo-java-driver-3.2.2.jar:na]
      at com.mongodb.DBCollection.insert(DBCollection.java:328) ~[mongo-java-driver-3.2.2.jar:na]
      }}

      Note this is not a theoretical bug report, the following exception was thrown on a productive system! Therefore please fix these strange and defect by design calculations...

            Assignee:
            jeff.yemin@mongodb.com Jeffrey Yemin
            Reporter:
            mango Jan S.
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: