RecordId doesn't use the length of the underlying buffer when constructing std::string representations thereof

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 8.3.0-rc0
    • Affects Version/s: None
    • Component/s: None
    • None
    • Storage Execution
    • Fully Compatible
    • ALL
    • Storage Execution 2025-09-01
    • 200
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      BF-39058 found a place in the RecordId implementation where we construct a std::string from a const char * taken from a StringData without passing the StringData length field. This results in a buffer overrun when calculating the length based on a NULL terminator when the underlying buffer isn't NULL-terminated. Regardless of whether it's correct for a RecordId to have a non-NULL-terminated underlying string, we should adapt the code in RecordId to be more resilient to buffer overruns.

      Either ensure that all std::string objects that are constructed in RecordId from StringData objects see the length field from the originating StringData or validate the NULL-termination of the StringData on ingestion (or both).

            Assignee:
            Shin Yee Tan
            Reporter:
            James Bronsted
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: