[SERVER-30720] Integer overflow in SharedBuffer::grow_reallocate Created: 17/Aug/17  Updated: 30/Oct/23  Resolved: 18/Aug/17

Status: Closed
Project: Core Server
Component/s: Internal Code
Affects Version/s: None
Fix Version/s: 3.4.11, 3.5.12

Type: Bug Priority: Major - P3
Reporter: Martin Neupauer Assignee: Martin Neupauer
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Related
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v3.4, v3.2, v3.0
Sprint: Query 2017-08-21, Query 2017-09-11
Participants:
Case:
Linked BF Score: 15

 Description   

When the minSize parameter greater than 1 GB is passed to the grow_reallocate function then the while loop inside the function causes integer overflow and loops forever.



 Comments   
Comment by Githook User [ 02/Jan/18 ]

Author:

{'name': 'Martin Neupauer', 'username': 'MartinNeupauer', 'email': 'martin.neupauer@mongodb.com'}

Message: SERVER-30720 Integer overflow in SharedBuffer::grow_reallocate

Move the length check before the while loop.

(cherry picked from commit 5bdeccdef411b3c8e19c19b2e5190119889eba61)
Branch: v3.4
https://github.com/mongodb/mongo/commit/f4fb2e84ebd22e49ce727ab108d2fd3f87b30d9e

Comment by Githook User [ 18/Aug/17 ]

Author:

{'username': 'MartinNeupauer', 'email': 'martin.neupauer@mongodb.com', 'name': 'Martin Neupauer'}

Message: SERVER-30720 Integer overflow in SharedBuffer::grow_reallocate

Move the length check before the while loop.
Branch: master
https://github.com/mongodb/mongo/commit/5bdeccdef411b3c8e19c19b2e5190119889eba61

Generated at Thu Feb 08 04:24:47 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.