-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Minor - P4
-
None
-
Affects Version/s: None
-
Component/s: None
-
Networking & Observability
-
ALL
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
In src/mongo/logv2/attribute_storage.h, the default constructor TypeErasedAttributeStorage() : _size(0) {} initializes only _size and does not initialize _data (a raw const detail::NamedAttribute*), which has no default member initializer. A default-constructed instance therefore holds an indeterminate _data.
begin() returns _data, end() returns _data + _size, and apply() iterates std::for_each(_data, _data + _size, ...). Merely reading the indeterminate _data value and forming the pointer expression _data + _size is undefined behavior, independent of dereferencing. In the default-constructed state _size == 0, so the resulting range is empty and no element is dereferenced, which limits the practical impact, but the read of the indeterminate pointer is still UB and the members are inconsistently initialized (only _size is set).
Found by static analysis (Svace, UNINIT.CTOR): "Constructor may not initialize class members of 'mongo::logv2::TypeErasedAttributeStorage'. Following members aren't initialized: _data."
Suggested fix: initialize _data in the default constructor (e.g. TypeErasedAttributeStorage() : _data(nullptr), _size(0) {}{}) or give it a default member initializer (const detail::NamedAttribute* _data = nullptr;)