[CDRIVER-787] segfault on network err in legacy update or delete Created: 10/Aug/15  Updated: 19/Oct/16  Resolved: 25/Aug/15

Status: Closed
Project: C Driver
Component/s: libmongoc
Affects Version/s: None
Fix Version/s: 1.2-beta1

Type: Bug Priority: Major - P3
Reporter: A. Jesse Jiryu Davis Assignee: A. Jesse Jiryu Davis
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
related to CDRIVER-788 Hang in large bulk upsert Closed

 Description   

This code calls bson_destroy (gle) on the result of a getlasterror call, when the getlasterror call has failed and the "gle" bson object is NULL:

https://github.com/mongodb/mongo-c-driver/blob/a0219c9777f90187fa73d3fa24c66030e0db2a04/src/mongoc/mongoc-write-command.c#L730

The result is a segfault.



 Comments   
Comment by Githook User [ 25/Aug/15 ]

Author:

{u'username': u'ajdavis', u'name': u'A. Jesse Jiryu Davis', u'email': u'jesse@mongodb.com'}

Message: CDRIVER-787 crash in legacy writes after network err

If _mongoc_client_recv_gle returned an error, the getlasterror object
was sometimes NULL, sometimes not. If NULL, the calls to bson_destroy
in update_legacy and delete_legacy crashed. If not NULL, then
insert_legacy leaked it, since there was no bson_destroy call there.

Ensure that gle is NULL iff _mongoc_client_recv_gle returns false.
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/70d6c651f5bcff0b27091b4dc4770f7a642827d8

Comment by Githook User [ 25/Aug/15 ]

Author:

{u'username': u'ajdavis', u'name': u'A. Jesse Jiryu Davis', u'email': u'jesse@mongodb.com'}

Message: CDRIVER-787 test OP_UPDATE and DELETE err handling

Reveals segfault if server hangs up while client waits to receive getlasterror
response.
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/6e790dd5c40dae832018b22ed4f1fc9d308e1a93

Comment by A. Jesse Jiryu Davis [ 10/Aug/15 ]

Same for deletes:

https://github.com/mongodb/mongo-c-driver/blob/a0219c9777f90187fa73d3fa24c66030e0db2a04/src/mongoc/mongoc-write-command.c#L330

Generated at Wed Feb 07 21:10:38 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.