I found a potential null pointer dereference in src/mongo/db/pipeline/document_source_list_local_sessions.cpp.

https://github.com/mongodb/mongo/blob/master/src/mongo/db/pipeline/document_source_list_local_sessions.cpp#L77-L102

In the listSessionsRequiredPrivileges function, the return value of Client::getCurrent()->getOperationContext() is passed to getUserNameForLoggedInUser() without being checked for nullptr:

{{const auto& myName =
getUserNameForLoggedInUser(Client::getCurrent()->getOperationContext());}}

According to the documentation of Client::getOperationContext(), this method may return nullptr even for an existing client if there is no active operation context:

"Gets the operation context active on this client, or nullptr if there is no such context."

If nullptr is returned and passed to getUserNameForLoggedInUser(), the function dereferences the null pointer without a prior check:

auto* client = opCtx->getClient();

This may lead to undefined behavior.

A similar unchecked call also exists in listSessionsParseSpec().

It is necessary to check the return value of getOperationContext() before passing it to getUserNameForLoggedInUser().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reporter: Grebennikov Aleksandr (grebennikov@bmstu.ru)