Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-60910

Make BSONArrayBuilder/BSONObjBuilder behavior crash on common mis-uses

    • Type: Icon: Improvement Improvement
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • Labels:
    • Storage Execution

      It is possible to "abuse" the BSONArrayBuilder/BSONObjBuilder interface by creating BSONArrayBuilder 'a', appending to it, calling doneFast(), creating builder 'b', and then using 'a' again. This misuse results in an object being created that looks very different from what the caller intended:

       

      TEST(BSONObjBuilderTest, BadUseTest) {                                                                                                                                                           
          BSONObjBuilder root;                                                                                                                                                                      
                                                                                                                                                                                                    
          BSONArrayBuilder array1(root.subobjStart("arr1"));                                                                                                                                        
                                                                                                                                                                                                    
          array1.append(3);                                                                                                                                                                                                                                                                                                                                                 
          array1.doneFast();                                                                                                                                                                        
                                                                                                                                                                                                    
          BSONArrayBuilder array2(root.subobjStart("arr2"));                                                                                                                                        
                                                                                                                                                                                                    
          // Notice how we're using 'array1' here. It'd be nice if this tripped an invariant or something.                                                                                            
          array1.append(4);                                                                                                                                                                         
                                                                                                                                                                                                    
          array2.doneFast();                                                                                                                                                                        
                                                                                                                                                                                                    
          // This "just works" even though it doesn't produce the object you'd expect.                                                                                                                       
          auto obj = root.done();                                                                                                                                                                                                                                                                                             
                                                                                                                                                                                                    
          // ... later someone tries to use the object.                                                                                                                                             
                                                                                                                                                                                                    
          std::cout << obj << std::endl;                                                                                                                                                            
          // Kind of a strange object, and clearly not what was intended:                                                                                                                                    
          // { arr1: { 0: 3 }, arr2: { 1: 4 } }                                                                                                                                                     
      }         

      It'd be nice if we could make some "best effort" to invariant/fail when BSONObjBuilder is misused in this way.

       

      An example of such mis-use in our actual codebase is SERVER-60909.

            Assignee:
            backlog-server-execution [DO NOT USE] Backlog - Storage Execution Team
            Reporter:
            ian.boros@mongodb.com Ian Boros
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: