RamLog can read past end of buffer

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Done
    • Priority: Major - P3
    • None
    • Affects Version/s: 2.0.7, 2.2.0
    • Component/s: Logging
    • None
    • ALL
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      When a log line is longer than 255 characters, RamLog::write() does a memcpy() from a string::c_str() without null-terminating the string buffer. I don't see any protection in the get functions (unless I'm missing something?), so we may get bad/bogus data (or even segv) when requesting the RamLog's contents.

      https://github.com/mongodb/mongo/blob/master/src/mongo/util/ramlog.cpp#L51

            Assignee:
            Unassigned
            Reporter:
            Ben Becker (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: