unsafe usage of namespace details transient on yield in update.cpp

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Done
    • Priority: Major - P3
    • 1.9.2
    • Affects Version/s: 1.8.1
    • Component/s: None
    • None
    • ALL
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      /* idea with these here it to make them loop invariant for multi updates, and thus be a bit faster for that case */
      /* NOTE: when yield() is added herein, these must be refreshed after each call to yield! */
      NamespaceDetails *d = nsdetails(ns); // can be null if an upsert...
      NamespaceDetailsTransient *nsdt = &NamespaceDetailsTransient::get_w(ns);
      /* end note */

      If we yield and if, for example, somebody calls NamespaceDetailsTransient::clearForPrefix() on a collection with a name that is a prefix of our collection's name, I think nsdt can point to freed memory even though we recover successfully from the yield.

              Assignee:
              Aaron Staple (Inactive)
              Reporter:
              Aaron Staple (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: