In src/mongo/db/query/write_ops/write_ops_exec.cpp, inside the shouldRetryDuplicateKeyException function, cq.getCollator() is dereferenced without an explicit null check:

if (!indexHasSimpleCollator && equalityElem.type() == BSONType::string) {
    if (keyValueElem.type() != BSONType::string)

{         return false;     }
    // Unchecked dereference of cq.getCollator()
    auto equalityComparisonString =
        cq.getCollator()->getComparisonString(equalityElem.valueStringData());
}

The getCollator() method can return nullptr (which represents a default "simple" collator). This specific code path is currently safe from a null pointer dereference because it is protected by the control flow earlier in the function:

1. queryHasSimpleCollator is checked earlier via isSimpleCollator(cq.getCollator()).
2. The code returns early if queryHasSimpleCollator != indexHasSimpleCollator.
3. The dereference only happens inside a block where !indexHasSimpleCollator is true, which implicitly guarantees that cq.getCollator() is not null.

Suggested Fix: Adding an explicit invariant and a local variable would document this assumed contract and protect the code against regressions if the upstream logic ever changes.

if (!indexHasSimpleCollator && equalityElem.type() == BSONType::string) {
    if (keyValueElem.type() != BSONType::string) {         return false;     }

    
    const auto* collator = cq.getCollator();
    invariant(collator); // Guaranteed to be non-null here because !queryHasSimpleCollator
    
    auto equalityComparisonString =
        collator->getComparisonString(equalityElem.valueStringData());
        
    // ...
}

Found Linux Verification Center ( linuxtesting.org ) with SVACE
Reporter: Grebennikov Aleksandr (grebennikov@bmstu.ru)