[SERVER-6186] $substr expression does not check arguments, can trigger an out_of_range exception causing mongod to abort Created: 23/Jun/12  Updated: 11/Jul/16  Resolved: 03/Jul/12

Status: Closed
Project: Core Server
Component/s: Aggregation Framework
Affects Version/s: None
Fix Version/s: 2.2.0-rc0

Type: Bug Priority: Critical - P2
Reporter: Aaron Staple Assignee: Aaron Staple
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Operating System: ALL
Participants:

 Description   

Observed behavior: The $substr expression implementation directly calls c++'s string::substr with numeric arguments supplied to it. If the pos argument is greater than the size of the string, string::substr will throw an out_of_range exception and the mongod process will abort.
Expected behavior: The $substr expression validates its arguments and returns an empty string or uasserts in this case.

Test:

c = db.c;
c.drop();
 
c.save( {} );
 
printjson( c.aggregate( { $project:{ a:{ $substr:[ 'a', 2, 1 ] } } } ) );

Log:

Fri Jun 22 17:32:47 [conn1] ERROR: Uncaught std::exception: basic_string::substr, terminating
Fri Jun 22 17:32:47 dbexit: 
Fri Jun 22 17:32:47 [conn1] shutdown: going to close listening sockets...
Fri Jun 22 17:32:47 [conn1] closing listening socket: 6
Fri Jun 22 17:32:47 [conn1] closing listening socket: 7
Fri Jun 22 17:32:47 [initandlisten] now exiting
Fri Jun 22 17:32:47 dbexit: ; exiting immediately



 Comments   
Comment by auto [ 03/Jul/12 ]

Author:

{u'date': u'2012-07-02T13:50:28-07:00', u'name': u'Aaron', u'email': u'aaron@10gen.com'}

Message: SERVER-6186 Return empty string when position index passed to substr is out of bounds.
Branch: master
https://github.com/mongodb/mongo/commit/bb3685d04ad800d4812c9d0b5c324ee9819316ed

Generated at Thu Feb 08 03:10:59 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.