Potential use-after-free in replication rollback

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Done
    • Priority: Major - P3
    • 2.7.8
    • Affects Version/s: None
    • Component/s: Replication
    • None
    • Fully Compatible
    • ALL
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      The rollback code creates and stores pointers to memory that is not guaranteed to still be alive here: https://github.com/mongodb/mongo/blob/master/src/mongo/db/repl/rs_rollback.cpp#L242

      At that call to insert, fixUpInfo can potentially outlive the data that doc points to. doc points to data from a query, which happens to always be alive in MMAPv1, but that might not be true for other storage engines.

            Assignee:
            David Percy (Inactive)
            Reporter:
            David Percy (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: