Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-83100

[CQF] Use-after-free in aggregation with parameterization enabled

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major - P3 Major - P3
    • 7.3.0-rc0
    • None
    • None
    • None
    • Fully Compatible
    • ALL
    • QO 2023-11-13, QO 2023-11-27

    Description

      An ASAN run of jstests/cqf/analyze/ce_sample_rate.js reveals a use-after-free with parameterization enabled.

      Binding of an SBE plan uses an unowned view into the MatchExpression to populate the value of query parameters for operands of comparison expressions. In the case of creating a PlanExecutor via Bonsai, the pipeline owning the MatchExpression goes out of scope right after constructing the executor, leaving a dangling reference.

      The binding should either copy the data to populate the slot or the SBE PlanExecutor constructed by Bonsai needs to extend the lifetime of the MatchExpression which the slot references.

      Attachments

        Activity

          People

            ben.shteinfeld@mongodb.com Ben Shteinfeld
            ben.shteinfeld@mongodb.com Ben Shteinfeld
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: