Validation of 2dsphereIndexVersion field during ensureIndex may exhibit undefined behavior

XMLWordPrintableJSON

    • Fully Compatible
    • ALL
    • Hide

      Run jstests/core/geo_s2indexversion1.js under UBSAN

      Show
      Run jstests/core/geo_s2indexversion1.js under UBSAN
    • Platforms 15 (06/03/16)
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      The S2AccessMethod::fixSpec method unconditionally extracts the field 2dsphereIndexVersion and then treats it as a number, even though it may contain non-normal values like Inf or Nan, potentially eliciting undefined behavior. The field should be type and bounds checked before being treated as a valid integer.

              Assignee:
              Andrew Morrow (Inactive)
              Reporter:
              Andrew Morrow (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: