[SERVER-22532] $type with invalid integer type code fails with unhelpful message and leaks memory - MongoDB Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed
Priority: Major - P3
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 3.2.4, 3.3.2
Component/s: Querying
Labels:
- code-and-test

Backwards Compatibility:
Fully Compatible
Operating System:
ALL
Backport Completed:

3.2.4
Steps To Reproduce:
Hide

db.c.drop();

db.c.ensureIndex({a: 1});

db.c.find({a: { $type: -100663046}}).hint({a: 1}).itcount();
Show
db.c.drop(); db.c.ensureIndex({a: 1}); db.c.find({a: { $type: -100663046}}).hint({a: 1}).itcount();
Sprint:
Query 10 (02/22/16)
Linked BF Score:
0

Description

The $type MatchExpression parsing code fails to validate that the numerical type code is valid. This leads to an unexpected exception being thrown inside the query planner, which in turn leaks memory.

Attachments

Issue Links

related to

SERVER-22626 fix $type unit tests on experimental decimal build

Closed

Activity

People

Assignee:: David Storch

Reporter:: David Storch

Participants:: David Storch, Githook User

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: Feb 09 2016 03:54:08 PM UTC

Updated:: Nov 20 2016 10:53:32 PM UTC

Resolved:: Feb 12 2016 04:44:08 PM UTC