Uploaded image for project: 'C Driver'
  1. C Driver
  2. CDRIVER-2280

Out-of-bounds write in legacy insert

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Works as Designed
    • Icon: Major - P3 Major - P3
    • 1.10.0
    • None
    • None
    • None

    Description

      Out-of-bounds write to a buffer

      Defect 102107 (STATIC_C)
      Checker OVERRUN (subcategory write)
      File: /src/mongoc/mongoc-write-command-legacy.c
      Function _mongoc_write_command_insert_legacy
      /src/mongoc/mongoc-write-command-legacy.c, line: 701
      Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

             iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 744
      Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

                   iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);

      File: /src/mongoc/mongoc-write-command-legacy.c
      Function _mongoc_write_command_insert_legacy
      /src/mongoc/mongoc-write-command-legacy.c, line: 701
      Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

             iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 744
      Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

                   iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);

      File: /src/mongoc/mongoc-write-command-legacy.c
      Function _mongoc_write_command_insert_legacy
      /src/mongoc/mongoc-write-command-legacy.c, line: 701
      Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

             iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 744
      Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

                   iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);

      File: /src/mongoc/mongoc-write-command-legacy.c
      Function _mongoc_write_command_insert_legacy
      /src/mongoc/mongoc-write-command-legacy.c, line: 701
      Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

             iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 712
      Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

                BSON_ASSERT (n_docs_in_batch <= idx);

      /src/mongoc/mongoc-write-command-legacy.c, line: 713
      Tracking "idx" since "command->n_documents" is tracked with "iov".

                BSON_ASSERT (idx <= command->n_documents);

      /src/mongoc/mongoc-write-command-legacy.c, line: 744
      Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

                   iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);

      Attachments

        Activity

          People

            roberto.sanchez@mongodb.com Roberto Sanchez
            xgen-internal-coverity Coverity Collector User
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: