[SERVER-29711] OP_GET_MORE view check can dereference a null pointer Created: 19/Jun/17  Updated: 30/Oct/23  Resolved: 19/Jun/17

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: 3.5.8
Fix Version/s: 3.5.9

Type: Bug Priority: Major - P3
Reporter: David Storch Assignee: David Storch
Resolution: Fixed Votes: 0
Labels: read-only-views
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Backwards Compatibility: Fully Compatible
Operating System: ALL
Sprint: Query 2017-07-10
Participants:
Linked BF Score: 0

 Description   

A globally-managed aggregation cursor can be established even if the database over which the aggregation is issued does not exist. On a subsequent OP_GET_MORE, a check is made that the aggregation namespace is not a view (since OP_GET_MORE on views is not supported):

https://github.com/mongodb/mongo/blob/ab165e7a81e319cd7e99af3e1eed86e826fd34ba/src/mongo/db/query/find.cpp#L281-L287

However, this code incorrectly assumes that the Database object exists. If it doesn't exist, getDb() will return null, causing this line to deference a null pointer and crash the server.

This issue was introduced during 3.5 development and does not affect any stable versions of MongoDB.



 Comments   
Comment by Githook User [ 19/Jun/17 ]

Author:

{u'username': u'dstorch', u'name': u'David Storch', u'email': u'david.storch@10gen.com'}

Message: SERVER-29711 Fix nullptr dereference in OP_GET_MORE view check.
Branch: master
https://github.com/mongodb/mongo/commit/47856e523e3d3c842f95ec277f33728130ad14dd

Generated at Thu Feb 08 04:21:37 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.