Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-48989

Fix use-after-free issue in document_diff_serialization_test.cpp

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major - P3 Major - P3
    • 4.7.0
    • None
    • None
    • None
    • Fully Compatible
    • ALL
    • 45

    Description

      ArrayDiffBuilder::addUpdate() does not take ownership of the data passed as BSONElement, which means that the temporary objects here gets freed after executing the line. When ArrayDiffBuilder tries to serialize, it expects the object to be still valid. We should also change all the other functions which pass a BSONElement, and not depend on the implementation of the DiffBuilders.

      Attachments

        Activity

          People

            arun.banala@mongodb.com Arun Banala
            arun.banala@mongodb.com Arun Banala
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: