[SERVER-31664] ExpressionDate*::evaluate() methods may access the ServiceContext via pointer to freed OperationContext Created: 20/Oct/17  Updated: 30/Oct/23  Resolved: 30/Oct/17

Status: Closed
Project: Core Server
Component/s: Aggregation Framework
Affects Version/s: None
Fix Version/s: 3.6.0-rc2

Type: Bug Priority: Major - P3
Reporter: James Wahlin Assignee: James Wahlin
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Backwards Compatibility: Fully Compatible
Operating System: ALL
Sprint: Query 2017-11-13
Participants:

 Description   

Aggregation expressions that need to access the TimeZoneDatabase will use an OperationContext* stored as part of the ExpressionContext to access the ServiceContext.

In the following case, the original OperationContext will have been freed prior to use:

  1. The time-zone dependent expression lives within a collection validator, as part of a $expr expression


 Comments   
Comment by Githook User [ 30/Oct/17 ]

Author:

{'email': 'james@mongodb.com', 'name': 'James Wahlin', 'username': 'jameswahlin'}

Message: SERVER-31664 Fix use after free of OperationContext by ExpressionDate*

Addresses the case where a time zone expression lives within a collection
validator as part of a $expr expression. In this case, the Expression
will outlive the OperationContext it was created under.
Branch: master
https://github.com/mongodb/mongo/commit/9becaec05921e0fd6eeb3e7bdf8c91ca1f6531c7

Generated at Thu Feb 08 04:27:47 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.