Possible use-after-free when reloading the view catalog due to an invalidation

XMLWordPrintableJSON

    • Fully Compatible
    • ALL
    • v4.0
    • Query 2018-07-16
    • 16
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      The resolvedNss = &(view->viewOn()) address refers to memory within ViewCatalog::_viewMap and would have therefore been freed when a subsequent iteration of ViewCatalog::_lookup_inlock() leads to ViewCatalog::_reloadIfNeeded_inlock() being called. This could happen if ViewCatalog::invalidate() is called concurrently while following a chain of view definitions in ViewCatalog::resolveView().

      Note: This issue cannot be triggered against MongoDB 3.4 or 3.6 because the parallel-batch writer lock prevents resolving a view definition from overlapping with oplog application.

              Assignee:
              Kyle Suarez (Inactive)
              Reporter:
              Max Hirschhorn
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: