[SERVER-13666] Near queries with out-of-bounds points in legacy format can lead to crash Created: 21/Apr/14  Updated: 11/Jul/16  Resolved: 21/Apr/14

Status: Closed
Project: Core Server
Component/s: Geo
Affects Version/s: 2.6.0
Fix Version/s: 2.6.1, 2.7.0

Type: Bug Priority: Major - P3
Reporter: nelson_guo Assignee: hari.khalsa@10gen.com
Resolution: Done Votes: 0
Labels: crash
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: Text File error_log.txt    
Issue Links:
Depends
Duplicate
is duplicated by SERVER-13751 mongod crash on geo nearSphere query Closed
Related
Operating System: ALL
Backport Completed:
Steps To Reproduce:

from bson import SON
from pymongo import Connection
from pymongo.errors import OperationFailure, AutoReconnect
 
db = Connection()["test"]
db.users.insert({"loc": [1, 2]})
db.users.insert({"loc": [2, 3]})
db.users.insert({"loc": [3, 4]})
db.users.ensure_index([("loc", "2dsphere")])
 
#right way just raise error
try:
    db.command(SON([('geoNear', 'users'), ('near', {'type': 'Point', 'coordinates': [100, 500]}), ('spherical', True),
                    ('minDistance', 0), ('query', {"loc": {"$exists": True}}), ('num', 48)]))
except OperationFailure as e:
    print e
""">>> command SON([('geoNear', 'users'), ('near', {'type': 'Point', 'coordinates': [100, 500]}), ('spherical', True),
 ('minDistance', 0), ('query', {'push': {'$gt': 0}}), ('num', 48)]) failed: exception: 'near' field must be point"""
 
 
 
#wrong way but result is ok
print db.command(SON([('geoNear', 'users'), ('near', [120.466, 31.2051]), ('spherical', True), ('minDistance', 0),
                      ('query', {"loc": {"$exists": True}}), ('num', 48)]))["ok"]
 
""">>> 1.0"""
 
 
#wrong way crash the server
try:
    db.command(SON([('geoNear', 'users'), ('near', [1210.466, 31.2051]), ('spherical', True), ('minDistance', 0),
                    ('query', {"loc": {"$exists": True}}), ('num', 48)]))
except AutoReconnect as e:
    print e
 
""">>>connection closed"""

Participants:

 Description   

Draft for release summary box:

Issue Status as of April 22, 2014

ISSUE SUMMARY
Query points provided in the legacy coordinate pair format using 2dsphere indexes are not correctly checked for whether they are in bounds. This affects both the geoNear command using the spherical option and the $nearSphere operator. Such out of bounds coordinates can crash the server.

USER IMPACT
A primary crash will lead to a fail-over in a replica set. If the queries continue to be sent to current primary (and cause a crash), this will affect quorum and potentially render the replica set inoperable.

WORKAROUNDS
Removing the spherical option for the query avoids the crash but will assume a flat surface instead of a spherical one. For small regions, the difference may be acceptable as a workaround.

RESOLUTION
The query now correctly checks for the bounds and aborts with an error, instead of crashing the server.

AFFECTED VERSIONS
Version 2.6.0 is affected by this bug.

PATCHES
The patch is included in the 2.6.1 production release.

Original description

use pymongo 2.7 client, when I runCommand query geoNear, the server crash.
I know that maybe the issue of the pymongo client, but the server crash when the coordinates is wrong.



 Comments   
Comment by Githook User [ 21/Apr/14 ]

Author:

{u'username': u'hkhalsa', u'name': u'Hari Khalsa', u'email': u'hkhalsa@10gen.com'}

Message: SERVER-13666 check that lat/lng are in bounds for near queries even if point is legacy
(cherry picked from commit 3286b208b30c43450354422e554070485f526e7b)
Branch: v2.6
https://github.com/mongodb/mongo/commit/246bfa4e9c365f585e3dc323f91b72e1dd16d127

Comment by Githook User [ 21/Apr/14 ]

Author:

{u'username': u'hkhalsa', u'name': u'Hari Khalsa', u'email': u'hkhalsa@10gen.com'}

Message: SERVER-13666 check that lat/lng are in bounds for near queries even if point is legacy
Branch: master
https://github.com/mongodb/mongo/commit/3286b208b30c43450354422e554070485f526e7b

Generated at Thu Feb 08 03:32:29 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.