Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-29711

OP_GET_MORE view check can dereference a null pointer

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major - P3
    • Resolution: Fixed
    • Affects Version/s: 3.5.8
    • Fix Version/s: 3.5.9
    • Component/s: Querying
    • Labels:
    • Backwards Compatibility:
      Fully Compatible
    • Operating System:
      ALL
    • Sprint:
      Query 2017-07-10
    • Linked BF Score:
      0

      Description

      A globally-managed aggregation cursor can be established even if the database over which the aggregation is issued does not exist. On a subsequent OP_GET_MORE, a check is made that the aggregation namespace is not a view (since OP_GET_MORE on views is not supported):

      https://github.com/mongodb/mongo/blob/ab165e7a81e319cd7e99af3e1eed86e826fd34ba/src/mongo/db/query/find.cpp#L281-L287

      However, this code incorrectly assumes that the Database object exists. If it doesn't exist, getDb() will return null, causing this line to deference a null pointer and crash the server.

      This issue was introduced during 3.5 development and does not affect any stable versions of MongoDB.

        Attachments

          Activity

            People

            Assignee:
            david.storch David Storch
            Reporter:
            david.storch David Storch
            Participants:
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: