Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-2335

NULL pointer crash in config_check_search with invalid configuration string

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Minor - P4 Minor - P4
    • WT2.8.0
    • Affects Version/s: None
    • Component/s: None
    • Labels:
      None

      An invalid 'configString' value leads to a NULL pointer being passed to strncmp and a crash:

      Program received signal SIGSEGV, Segmentation fault.
      [Switching to Thread 0x7fffe4997700 (LWP 21860)]
      0x00007ffff4e5a3c4 in strncmp () from /usr/lib/x86_64-linux-gnu/libasan.so.0
      (gdb) f 1
      #1  0x0000000003e74451 in config_check_search (session=0x7fffe49850c0, checks=0x5618e00 <confchk_WT_SESSION_create>, entries=40, str=0x0, len=105785044954802, ip=0x7fffe4984cd0)
          at src/third_party/wiredtiger/src/config/config_check.c:58
      58				cmp = strncmp(checks[indx].name, str, len);
      (gdb) p str
      $6 = 0x0
      
      (gdb) bt
      #0  0x00007ffff4e5a3c4 in strncmp () from /usr/lib/x86_64-linux-gnu/libasan.so.0
      #1  0x0000000003e74451 in config_check_search (session=0x7fffe49850c0, checks=0x5618e00 <confchk_WT_SESSION_create>, entries=40, str=0x0, len=105785044954802, ip=0x7fffe4984cd0)
          at src/third_party/wiredtiger/src/config/config_check.c:58
      #2  0x0000000003e7483d in config_check (session=0x7fffe49850c0, checks=0x5618e00 <confchk_WT_SESSION_create>, checks_entries=40, config=0x60360006eeb1 "}", config_len=0)
          at src/third_party/wiredtiger/src/config/config_check.c:105
      #3  0x0000000003e74178 in __wt_config_check (session=0x7fffe49850c0, entry=0x556eca0 <config_entries+544>, config=0x60360006eeb1 "}", config_len=0) at src/third_party/wiredtiger/src/config/config_check.c:27
      #4  0x0000000003e72d1a in wiredtiger_config_validate (wt_session=0x0, handler=0x7fffe49936d0, name=0x46360a0 "WT_SESSION.create", config=0x60360006eeb1 "}")
          at src/third_party/wiredtiger/src/config/config_api.c:171
      #5  0x00000000029658a4 in mongo::WiredTigerUtil::checkTableCreationOptions (configElem=...) at src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp:246
      #6  0x000000000291d9b5 in mongo::WiredTigerIndex::parseIndexOptions (options=...) at src/mongo/db/storage/wiredtiger/wiredtiger_index.cpp:138
      #7  0x000000000292b1ea in mongo::(anonymous namespace)::WiredTigerFactory::validateIndexStorageOptions (this=0x600400007070, options=...) at src/mongo/db/storage/wiredtiger/wiredtiger_init.cpp:108
      #8  0x0000000001f4d9d0 in std::_Mem_fn<mongo::Status (mongo::StorageEngine::Factory::*)(mongo::BSONObj const&) const>::operator()<mongo::BSONObj const&, void> (this=0x6006000fdb10, __object=0x600400007070)
          at /usr/include/c++/4.8/functional:681
      #9  0x0000000001f4d198 in std::_Bind<std::_Mem_fn<mongo::Status (mongo::StorageEngine::Factory::*)(mongo::BSONObj const&) const> (std::_Placeholder<1>, std::_Placeholder<2>)>::__call<mongo::Status<mongo::StorageEngine::Factory const*&&, mongo::BSONObj const&>, 0ul, 1ul> (this=0x6006000fdb10, __args=<unknown type in /home/s/code/mongo/mongo/mongod, CU 0x121f5ca, DIE 0x12991b6>)
          at /usr/include/c++/4.8/functional:1296
      #10 0x0000000001f4cac2 in std::_Bind<std::_Mem_fn<mongo::Status (mongo::StorageEngine::Factory::*)(mongo::BSONObj const&) const> (std::_Placeholder<1>, std::_Placeholder<2>)>::operator()<mongo::StorageEngine::Factory const*, mongo::BSONObj const&, mongo::Status>(mongo::StorageEngine::Factory const*&&, mongo::BSONObj const&) (this=0x6006000fdb10) at /usr/include/c++/4.8/functional:1355
      #11 0x0000000001f4be60 in std::_Function_handler<mongo::Status (mongo::StorageEngine::Factory const*, mongo::BSONObj const&), std::_Bind<std::_Mem_fn<mongo::Status (mongo::StorageEngine::Factory::*)(mongo::BSONObj const&) const> (std::_Placeholder<1>, std::_Placeholder<2>)> >::_M_invoke(std::_Any_data const&, mongo::StorageEngine::Factory const*, mongo::BSONObj const&) (__functor=..., __args#0=0x600400007070, 
          __args#1=...) at /usr/include/c++/4.8/functional:2057
      #12 0x00000000027c9314 in std::function<mongo::Status (mongo::StorageEngine::Factory const*, mongo::BSONObj const&)>::operator()(mongo::StorageEngine::Factory const*, mongo::BSONObj const&) const (
          this=0x7fffe49941d0, __args#0=0x600400007070, __args#1=...) at /usr/include/c++/4.8/functional:2471
      #13 0x00000000027c77cd in mongo::validateStorageOptions(mongo::BSONObj const&, std::function<mongo::Status (mongo::StorageEngine::Factory const*, mongo::BSONObj const&)>) (storageEngineOptions=..., 
          validateFunc=...) at src/mongo/db/service_context.cpp:100
      #14 0x0000000001f5aff8 in mongo::IndexCatalog::_isSpecOk (this=0x60360006e170, spec=...) at src/mongo/db/catalog/index_catalog.cpp:599
      #15 0x0000000001f57446 in mongo::IndexCatalog::prepareSpecForCreate (this=0x60360006e170, txn=0x601600036ee0, original=...) at src/mongo/db/catalog/index_catalog.cpp:273
      #16 0x0000000001f6a1b1 in mongo::MultiIndexBlock::removeExistingIndexes (this=0x7fffe4994a10, specs=0x7fffe49949d0) at src/mongo/db/catalog/index_create.cpp:132
      #17 0x0000000001fa5833 in mongo::CmdCreateIndex::run (this=0x59a6ac0 <mongo::cmdCreateIndex>, txn=0x601600036ee0, dbname=..., cmdObj=..., options=0, errmsg=..., result=...)
          at src/mongo/db/commands/create_indexes.cpp:193
      #18 0x000000000209ed63 in mongo::Command::run (this=0x59a6ac0 <mongo::cmdCreateIndex>, txn=0x601600036ee0, request=..., replyBuilder=0x7fffe4995870) at src/mongo/db/dbcommands.cpp:1451
      #19 0x000000000209d76c in mongo::Command::execCommand (txn=0x601600036ee0, command=0x59a6ac0 <mongo::cmdCreateIndex>, request=..., replyBuilder=0x7fffe4995870) at src/mongo/db/dbcommands.cpp:1326
      #20 0x0000000001f8deb0 in mongo::runCommands (txn=0x601600036ee0, request=..., replyBuilder=0x7fffe4995870) at src/mongo/db/commands.cpp:498
      #21 0x00000000022a1297 in mongo::(anonymous namespace)::receivedRpc (txn=0x601600036ee0, client=..., dbResponse=..., message=...) at src/mongo/db/instance.cpp:304
      #22 0x00000000022a2a5f in mongo::assembleResponse (txn=0x601600036ee0, m=..., dbresponse=..., remote=...) at src/mongo/db/instance.cpp:525
      #23 0x0000000001d1b5d9 in mongo::MyMessageHandler::process (this=0x600400006690, m=..., port=0x600e000198c0) at src/mongo/db/db.cpp:173
      #24 0x0000000002cdccab in mongo::PortMessageServer::handleIncomingMsg (arg=0x600e000198c0) at src/mongo/util/net/message_server_port.cpp:229
      #25 0x00007ffff4e63b98 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0
      #26 0x00007ffff4009182 in start_thread (arg=0x7fffe4997700) at pthread_create.c:312
      #27 0x00007ffff3d3647d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
      

      MongoDB version: 3c287ede73fe151729b5fec4801b367453c9f86d

            Assignee:
            keith.bostic@mongodb.com Keith Bostic (Inactive)
            Reporter:
            kamran.khan Kamran K.
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: