Uploaded image for project: 'Python Driver'
  1. Python Driver
  2. PYTHON-2191

Double free in C extensions when realloc fails in buffer_grow

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major - P3
    • Resolution: Fixed
    • None
    • 3.11
    • None
    • None

    Description

      When buffer_grow’s realloc call fails it frees the buffer:
      https://github.com/mongodb/mongo-python-driver/blob/3.10.1/bson/buffer.c#L82

      This causes a double free later on (for example in _write_dict_to_bson) because the buffer struct is not "owned" by buffer_grow. A fix should ensure that the caller of buffer_grow can always free the buffer, even on error.

      Noticed by Coverity.

      Attachments

        Activity

          People

            shane.harvey@mongodb.com Shane Harvey
            shane.harvey@mongodb.com Shane Harvey
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: