[CDRIVER-880] mongoc_collection_aggregate might return a destroyed cursor Created: 24/Sep/15  Updated: 19/Oct/16  Resolved: 01/Oct/15

Status: Closed
Project: C Driver
Component/s: libmongoc
Affects Version/s: 1.2-beta1
Fix Version/s: 1.2-rc0

Type: Bug Priority: Major - P3
Reporter: Yuval Hager Assignee: Kyle Suarez
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Related
is related to CDRIVER-926 mongoc_collection_aggregate can retur... Closed

 Description   

mongoc_collection_aggregate has a check for cursor validity, and if it fails, calls mongoc_cursor_destroy (around line 300 in mongoc-collection.c.

This code can be reached in situations when the mongodb server misbehaves, returns an invalid cursor, has a memory issue, or just crashes.

The destroyed cursor is then returned to the caller, which usually quickly identifies it is invalid, and calls mongoc_cursor_destroy, which leads to a double-free crash.

The example code given in http://api.mongodb.org/c/current/aggregate.html will crash if this occurs.

It looks like this was working before by creating a dummy cursor, but this code was removed in commit 346349d8d1e721e782d (as part of CDRIVER-735).



 Comments   
Comment by Yuval Hager [ 04/Oct/15 ]

Awesome! Thanks guys!

Comment by Kyle Suarez [ 01/Oct/15 ]

Thanks again yhager for catching this! The fix has been released in 1.2.0-rc0:

https://github.com/mongodb/mongo-c-driver/releases/tag/1.2.0-rc0

Comment by Githook User [ 01/Oct/15 ]

Author:

{u'username': u'bjori', u'name': u'Hannes Magnusson', u'email': u'bjori@10gen.com'}

Message: Merge pull request #278 from ksuarz/CDRIVER-880

CDRIVER-880: aggregation may return destroyed cursor
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/bef2b38ec5ea181b17b0f393b6e60e8138ad4e47

Comment by Githook User [ 01/Oct/15 ]

Author:

{u'username': u'bjori', u'name': u'Hannes Magnusson', u'email': u'bjori@10gen.com'}

Message: Merge pull request #278 from ksuarz/CDRIVER-880

CDRIVER-880: aggregation may return destroyed cursor
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/bef2b38ec5ea181b17b0f393b6e60e8138ad4e47

Comment by Githook User [ 01/Oct/15 ]

Author:

{u'username': u'ksuarz', u'name': u'Kyle Suarez', u'email': u'ksuarz@gmail.com'}

Message: CDRIVER-880 must still call cursorid_prime()

We require the side effects of the function but ignore its return value.
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/e6349245282a78e3c2b0dbd15e14b15e033c691f

Comment by Githook User [ 01/Oct/15 ]

Author:

{u'username': u'ksuarz', u'name': u'Kyle Suarez', u'email': u'ksuarz@gmail.com'}

Message: CDRIVER-880 add test for failed agg pipeline
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/558906fb7e79a72b6662913814d715b2b865790c

Comment by Githook User [ 01/Oct/15 ]

Author:

{u'username': u'ksuarz', u'name': u'Kyle Suarez', u'email': u'ksuarz@gmail.com'}

Message: CDRIVER-880 style fix
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/14c9bdf1b92807d121a1ba1d35c90a93492be0d8

Comment by Githook User [ 01/Oct/15 ]

Author:

{u'username': u'ksuarz', u'name': u'Kyle Suarez', u'email': u'ksuarz@gmail.com'}

Message: CDRIVER-880 do not destroy cursor before failing
Branch: 1.2.0-dev
https://github.com/mongodb/mongo-c-driver/commit/93a9456586ba684bda58218439a8f2c56635b461

Comment by A. Jesse Jiryu Davis [ 24/Sep/15 ]

Thanks for the report! Seems easy to reproduce given the mock_server_t I've added to the test framework and your detailed explanation. We'll plan to fix this before the 1.2.0 release candidate next week.

Generated at Wed Feb 07 21:10:53 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.