Details
-
Bug
-
Status: Closed
-
Major - P3
-
Resolution: Fixed
-
None
-
None
-
None
Description
When buffer_grow’s realloc call fails it frees the buffer:
https://github.com/mongodb/mongo-python-driver/blob/3.10.1/bson/buffer.c#L82
This causes a double free later on (for example in _write_dict_to_bson) because the buffer struct is not "owned" by buffer_grow. A fix should ensure that the caller of buffer_grow can always free the buffer, even on error.
Noticed by Coverity.