Unchecked boost::optional usage in DocumentSourceInternalSetWindowFields

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 4.9.0
    • Affects Version/s: None
    • Component/s: None
    • None
    • Fully Compatible
    • ALL
    • Hide

      Execute an aggregation pipeline with $setWindowFields on an empty collection.

      Show
      Execute an aggregation pipeline with $setWindowFields on an empty collection.
    • 66
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None

      This line in DocumentSourceInternalSetWindowFields::doGetNext() calls the [] overload on a PartitionIterator but then calls the get() method on the resulting optional without checking if it is boost::none. The [] overload can return boost::none, however, resulting in access to uninitialized memory and potential crashes.

      The simplest case I found where this happens is when there are no input documents to the $setWindowFields stage.

            Assignee:
            Nicholas Zolnierz
            Reporter:
            Justin Seyster
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: