Overview
MongoDB server may crash when a Geo object parsing first goes though `GeoJSON` parsing but fails, then fall back to legacy point parsing, which is successful. This is due to the `GeoJSON` parsing doesn't clean up `_polygon` when it fails. The stale _polygon then poisons the downstream logic. When downstream logic `projectInto` and `getS2Region` uses the stale state, it may dereference a null point, and cause system crash.
There are three conditions to hit a system crash:
- Does not clean up stale state when GeoJSON parsing fails.
- Code has fallback mechanism when GeoJSON parsing fails.
- The fallback legacy point parsing is successful.
The stale state when GeoJSON parsing fails happen to all the released version. The fallback is introduced in v8.2. On 8.3+, the fallback is only applied with v4 (`S2_INDEX_VERSION_4`) index. The code will not early exit, and try to access the stale state, and eventually hit system crash due to null pointer dereference.
On 8.3+ versions:
- Collection with V4 index may cause server crash, when fallback happens.
On 8.2:
- Collection with V1, V2 and V3 index may cause server crash, when fallback happens.
On 8.0, 7.0:
- There is no fallback mechanism. Even the code did not clean up stale state, it will exit early with GeoJSON parsing failure, and will NOT hit server crash.
Fix
The fix is to clean up the stale state when GeoJSON parsing fails on `master`, v8.3, and v8.2. It's not necessary to backport the fix to v8.0/v7.0 release.