Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-3991

Indexing past the end of a string in mongo shell

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 2.1.0
    • Affects Version/s: 2.0.0
    • Component/s: Shell
    • Labels:
      None
    • Environment:
      Any
    • ALL

      In the mongo shell's dbshell.cpp file, the routine isBalanced() tries to figure out if you have finished typing. It checks to see if parentheses and braces are balanced and whether you might not be finished typing a long quoted string. The checking for balanced "()" and "{}" uses counters, but for apostrophes ("single quotes") and double quotes it uses a different method and fast forwards through the string looking for the matching element. This is a problem, because after this code breaks out of its switch statement there is a bit more code that assumes that the index variable is still in range. It isn't; the fast forward algorithm has set the index 'i' to code.size() and the expression 'code[i]' indexes off the end of the string.
      To see this, run the debug build of the mongo shell in Windows, type the single character "'" and press return. You get a debug assertion from the runtime. I'm not quite sure why non-debug builds sail past this error, but the algorithm needs some fine tuning to keep string referencing in bounds.

            Assignee:
            eliot Eliot Horowitz (Inactive)
            Reporter:
            tad Tad Marshall
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: