Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-55054

Unchecked boost::optional usage in DocumentSourceInternalSetWindowFields

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major - P3
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 4.9.0
    • Component/s: None
    • Labels:
      None
    • Backwards Compatibility:
      Fully Compatible
    • Operating System:
      ALL
    • Steps To Reproduce:
      Hide

      Execute an aggregation pipeline with $setWindowFields on an empty collection.

      Show
      Execute an aggregation pipeline with $setWindowFields on an empty collection.
    • Linked BF Score:
      66

      Description

      This line in DocumentSourceInternalSetWindowFields::doGetNext() calls the [] overload on a PartitionIterator but then calls the get() method on the resulting optional without checking if it is boost::none. The [] overload can return boost::none, however, resulting in access to uninitialized memory and potential crashes.

      The simplest case I found where this happens is when there are no input documents to the $setWindowFields stage.

        Attachments

          Activity

            People

            Assignee:
            nicholas.zolnierz Nicholas Zolnierz
            Reporter:
            justin.seyster Justin Seyster
            Participants:
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: