[SERVER-45279] GranularityRounder can get stuck in loop when rounding infinity Created: 20/Dec/19  Updated: 29/Oct/23  Resolved: 14/Jan/20

Status: Closed
Project: Core Server
Component/s: Querying
Affects Version/s: None
Fix Version/s: 3.6.17, 4.2.4, 4.3.3, 4.0.16

Type: Bug Priority: Major - P3
Reporter: Ian Boros Assignee: Sophie Saskin
Resolution: Fixed Votes: 0
Labels: afz, qexec-team
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Backports
Depends
Duplicate
is duplicated by SERVER-45462 $bucketAuto's granularity field shoul... Closed
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v4.2, v4.0, v3.6
Participants:
Linked BF Score: 23

 Description   

This code will loop for forever when number is the double value infinity. Repro:

diff --git a/src/mongo/db/pipeline/granularity_rounder_preferred_numbers_test.cpp b/src/mongo/db/pipeline/granularity_rounder_preferred_numbers_test.cpp
index e4d8600b40..ae97faa6d2 100644
--- a/src/mongo/db/pipeline/granularity_rounder_preferred_numbers_test.cpp
+++ b/src/mongo/db/pipeline/granularity_rounder_preferred_numbers_test.cpp
@@ -528,5 +528,17 @@ TEST(GranularityRounderPreferredNumbersTest, ShouldFailOnRoundingNegativeNumber)
         ASSERT_THROWS_CODE(rounder->roundDown(negativeNumber), AssertionException, 40268);
     }
 }
+
+TEST(GranularityRounderPreferredNumbersTest, infinity) {
+    auto rounder =
+        GranularityRounder::getGranularityRounder(new ExpressionContextForTest(), "E192");
+
+    Value inf = Value(std::numeric_limits<double>::infinity());
+    rounder->roundUp(inf);
+
+    ASSERT_EQ(true, false); // never get here
+}
 }  // namespace
 }  // namespace mongo

Note that the right hand side will eventually get to infinity, but infinity won't compare less than or greater than itself so it just spins in the loop.

It's possible to trigger this bug through aggregate() as well (the fuzzer has caught this for us).



 Comments   
Comment by Githook User [ 24/Jan/20 ]

Author:

{'username': 'puppyofkosh', 'name': 'Ian Boros', 'email': 'ian.boros@mongodb.com'}

Message: SERVER-45279 GranularityRounder rounding infinity case no longer causes infinite loop

(cherry picked from commit a028f3c1888ecb35cd99435658f875b0963ed2f7)
Branch: v4.2
https://github.com/mongodb/mongo/commit/0de5336ea83306b263eb304ea6a5dd5f85d66186

Comment by Githook User [ 24/Jan/20 ]

Author:

{'username': 'puppyofkosh', 'name': 'Ian Boros', 'email': 'ian.boros@mongodb.com'}

Message: SERVER-45279 GranularityRounder rounding infinity case no longer causes infinite loop

(cherry picked from commit a028f3c1888ecb35cd99435658f875b0963ed2f7)
Branch: v4.0
https://github.com/mongodb/mongo/commit/da10609010f8b13307206b21e45b729c6d10d40d

Comment by Githook User [ 21/Jan/20 ]

Author:

{'email': 'ian.boros@mongodb.com', 'name': 'Ian Boros', 'username': 'puppyofkosh'}

Message: SERVER-45279 GranularityRounder rounding infinity case no longer causes infinite loop

(cherry picked from commit a028f3c1888ecb35cd99435658f875b0963ed2f7)
Branch: v3.6
https://github.com/mongodb/mongo/commit/205777cb0f84ee2c1719203e15e82d67c11ba8b6

Comment by Githook User [ 14/Jan/20 ]

Author:

{'name': 'Sophie Saskin', 'email': 'sophie.saskin@mongodb.com'}

Message: SERVER-45279 GranularityRounder rounding infinity case no longer causes infinite loop
Branch: master
https://github.com/mongodb/mongo/commit/a028f3c1888ecb35cd99435658f875b0963ed2f7

Generated at Thu Feb 08 05:08:23 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.