[SERVER-21957] Circular JS objects cause use-after-free in ObjectWrapper::toBSON Created: 18/Dec/15  Updated: 08/Jan/24  Resolved: 21/Dec/15

Status: Closed
Project: Core Server
Component/s: JavaScript
Affects Version/s: 3.2.0
Fix Version/s: 3.2.13, 3.3.0

Type: Bug Priority: Major - P3
Reporter: Andrew Morrow (Inactive) Assignee: Andrew Morrow (Inactive)
Resolution: Done Votes: 0
Labels: bkp
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v3.2
Steps To Reproduce:

Run the depth_limit.js script in a shell running under valgrind

Sprint: Platforms 2017-03-27
Participants:

 Description   

The BSONObjBuilder declared in ObjectWrapper::toBSON needs to remain in scope until after all of the WriteFieldRecursionFrame objects in the 'frames' LifetimeStack are destroyed, because each frame, when destroyed, may write to memory owned by the BSONObjBuilder.

Unfortunately, the BSONObjBuilder is declared after the frames object. So, normal object destruction sequencing means that the BSONObjBuilder will be destroyed before the frames, leading to a use after free.

Note that during normal processing, this won't happen, as the loop that comprises the primary body of the function pops (and destroys) all frames before leaving the function. In that case, any frames that had referenced the BSONObjBuilder have already been destroyed.

However, if the function is exited via an exception, as would happen if the object being walked was circular, then the frames have not all been popped, and the incorrect object sequencing will result in a use-after-free.



 Comments   
Comment by Githook User [ 10/Apr/17 ]

Author:

{u'username': u'acmorrow', u'name': u'Andrew Morrow', u'email': u'acm@mongodb.com'}

Message: SERVER-21957 Don't destroy builder while still in use

(cherry picked from commit effa414a8262d0816dd4c879260a6ce96b0d1fb5)
Branch: v3.2
https://github.com/mongodb/mongo/commit/a1270d5ecb4f9deae0edf212f7342e10767da242

Comment by Githook User [ 21/Dec/15 ]

Author:

{u'username': u'acmorrow', u'name': u'Andrew Morrow', u'email': u'acm@mongodb.com'}

Message: SERVER-21957 Don't destroy builder while still in use
Branch: master
https://github.com/mongodb/mongo/commit/effa414a8262d0816dd4c879260a6ce96b0d1fb5

Generated at Thu Feb 08 03:58:55 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.