[SERVER-40869] $subtract with date can cause undefined behavior Created: 26/Apr/19 Updated: 29/Oct/23 Resolved: 11/Jun/19 |
|
| Status: | Closed |
| Project: | Core Server |
| Component/s: | Querying |
| Affects Version/s: | 4.0.9, 4.1.10 |
| Fix Version/s: | 4.0.11, 4.2.0-rc1, 4.3.1 |
| Type: | Bug | Priority: | Major - P3 |
| Reporter: | Ian Boros | Assignee: | Ted Tuckman |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | afz | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||
| Backwards Compatibility: | Fully Compatible | ||||||||||||
| Operating System: | ALL | ||||||||||||
| Backport Requested: |
v4.2, v4.0, v3.6, v3.4
|
||||||||||||
| Participants: | |||||||||||||
| Linked BF Score: | 7 | ||||||||||||
| Description |
|
The following test results in UB:
The $subtract is performed with [<some date>, Infinity]. This causes this conversion to long long. This cast is UB when the truncated double is a value that can't fit in a long long (such as Infinity). We may want to change the implementation of Value::coerceToLong() and audit existing calls to it in case there are similar bugs. |
| Comments |
| Comment by Githook User [ 25/Jun/19 ] |
|
Author: {'name': 'Ted Tuckman', 'email': 'TedTuckman@users.noreply.github.com', 'username': 'TedTuckman'}Message: |
| Comment by Githook User [ 11/Jun/19 ] |
|
Author: {'name': 'Ted Tuckman', 'email': 'ted.tuckman@mongodb.com', 'username': 'TedTuckman'}Message: (cherry picked from commit dd1295d603e94cc8157238d41aaa909f45446526) |
| Comment by Githook User [ 11/Jun/19 ] |
|
Author: {'name': 'Ted Tuckman', 'email': 'ted.tuckman@mongodb.com', 'username': 'TedTuckman'}Message: (cherry picked from commit dd1295d603e94cc8157238d41aaa909f45446526) |
| Comment by Githook User [ 11/Jun/19 ] |
|
Author: {'name': 'Ted Tuckman', 'email': 'ted.tuckman@mongodb.com', 'username': 'TedTuckman'}Message: |
| Comment by Githook User [ 07/Jun/19 ] |
|
Author: {'name': 'Ted Tuckman', 'email': 'TedTuckman@users.noreply.github.com', 'username': 'TedTuckman'}Message: |
| Comment by Githook User [ 05/Jun/19 ] |
|
Author: {'name': 'Gregory Wlodarek', 'email': 'gregory.wlodarek@mongodb.com', 'username': 'GWlodarek'}Message: Revert " This reverts commit bcad0d20e517e10f0dab71a0cfabe0a9e25c401b. |
| Comment by Githook User [ 05/Jun/19 ] |
|
Author: {'name': 'Ted Tuckman', 'email': 'ted.tuckman@mongodb.com', 'username': 'TedTuckman'}Message: |
| Comment by Ian Boros [ 02/May/19 ] |
|
Yep! On PPC, for example, that error will not be triggered and I believe the query will complete. |
| Comment by Asya Kamsky [ 02/May/19 ] |
|
On 4.0.9 I just get an error back that "Cannot negate the minimum duration" (presumably from overflow when casting). Is this different on different platforms? |