Details
-
Bug
-
Resolution: Works as Designed
-
Major - P3
-
None
-
None
-
None
Description
Out-of-bounds write to a buffer
Defect 102107 (STATIC_C)
Checker OVERRUN (subcategory write)
File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".
iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".
iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);
|
File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".
iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".
iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);
|
File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".
iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".
iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);
|
File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".
iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".
BSON_ASSERT (n_docs_in_batch <= idx);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".
BSON_ASSERT (idx <= command->n_documents);
|
/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".
iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);
|