-
Type: Bug
-
Resolution: Done
-
Priority: Major - P3
-
None
-
Affects Version/s: None
-
Component/s: Internal Code, Stability
-
None
-
ALL
-
Execution Team 2022-04-04
If a BSONObjBuilder or BSONArrayBuilder is destroyed and done() or obj() have not been called, _done() is invoked by the destructor.
_done(), in turn, calls _BufBuilder::grow() to make space for EOO.
When an attempt is made by _BufBuilder::grow_reallocate() (called by grow()) to expand the buffer over BufferMaxSize a MsgAssertionException is raised by msgasserted(13548, "BufBuilder attempted to grow() " ... " past the 64MB limit").
This exception is not catchable and crashes the process.
A suboptimal workaround is to make sure to call *Builder::doneFast() before the builder's destructor is invoked when there's a chance that the constructed BSONObject exceeds 64MB.
A possible solution involves reserving space for EOO when creating a builder so that the destructor never needs to grow the buffer to append EOO.
- related to
-
SERVER-17224 Aggregation pipeline with 64MB document can terminate server
- Closed
-
SERVER-17226 'top' command with 64MB result document can terminate server
- Closed