Details
Major - P3 Description
The following test results in UB:
(function() {
|
pipeline = [{$project: {x: { $subtract: [new Date('2019-04-23T00:05:48.829Z'), Infinity] }}}];
|
|
db.adminCommand( { setParameter: 1, traceExceptions: true } )
|
|
try {
|
const res = db.c.aggregate(pipeline).toArray();
|
print("Result was " + tojson(res));
|
} catch(e) {
|
print("Error was " + tojson(e));
|
}
|
})();
|
The $subtract is performed with [<some date>, Infinity]. This causes this conversion to long long. This cast is UB when the truncated double is a value that can't fit in a long long (such as Infinity).
We may want to change the implementation of Value::coerceToLong() and audit existing calls to it in case there are similar bugs.