Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-7459

BSONObjBuilder and BSONArrayBuilder may throw (msgasserted) in destructor

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: Internal Code, Stability
    • None
    • ALL
    • Execution Team 2022-04-04

      If a BSONObjBuilder or BSONArrayBuilder is destroyed and done() or obj() have not been called, _done() is invoked by the destructor.
      _done(), in turn, calls _BufBuilder::grow() to make space for EOO.
      When an attempt is made by _BufBuilder::grow_reallocate() (called by grow()) to expand the buffer over BufferMaxSize a MsgAssertionException is raised by msgasserted(13548, "BufBuilder attempted to grow() " ... " past the 64MB limit").
      This exception is not catchable and crashes the process.

      A suboptimal workaround is to make sure to call *Builder::doneFast() before the builder's destructor is invoked when there's a chance that the constructed BSONObject exceeds 64MB.

      A possible solution involves reserving space for EOO when creating a builder so that the destructor never needs to grow the buffer to append EOO.

            Assignee:
            henrik.edin@mongodb.com Henrik Edin
            Reporter:
            andrea.lattuada@10gen.com Andrea Lattuada (Inactive)
            Votes:
            1 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated:
              Resolved: