Arithmetic overflow in mongo::nsDBHash

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Gone away
    • Priority: Minor - P4
    • None
    • Affects Version/s: None
    • Component/s: Internal Code
    • Storage Execution
    • ALL
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      After just a few characters, this function will overflow the signed int 'hash', which is undefined behavior. Conjecture: it might even be exploitable by an optimizer since the function is inline.

      inline int nsDBHash(const std::string& ns) {                                                                                 
          int hash = 7; 
          for (size_t i = 0; i < ns.size(); i++) {                                                                                 
              if (ns[i] == '.')                                                                                                    
                  break; 
              hash += 11 * ns[i];                                                                                                  
              hash *= 3;                                                                                                           
          }
          return hash;                                                                                                             
      }                                                                                                                            
      

      I suggest we switch to unsigned math for the bit wrangling and cast to int at the end.

      https://github.com/mongodb/mongo/commit/bc2d722169d5d1b46adfc603e29730b029b5e933#diff-fad15cbf66c82ba4a36fd2cc2e1c0b00R584

            Assignee:
            [DO NOT USE] Backlog - Storage Execution Team
            Reporter:
            Billy Donahue
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: