[SERVER-72001] SBE traverseP_nested frees memory incorrectly if expression is invalid Created: 09/Dec/22  Updated: 29/Oct/23  Resolved: 12/Dec/22

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 6.3.0-rc0

Type: Bug Priority: Major - P3
Reporter: Ivan Fefer Assignee: Ivan Fefer
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Duplicate
Related
is related to SERVER-69875 De-stage-ify the SBE expression stage... Closed
Backwards Compatibility: Fully Compatible
Operating System: ALL
Participants:
Linked BF Score: 135

 Description   

It passes invalid tag type to the ValueGuard that is used only if expression fails

https://github.com/mongodb/mongo/blob/master/src/mongo/db/exec/sbe/vm/vm.cpp#L1020

It creates an array, but passes tag from input, which can be any of the following:
https://github.com/mongodb/mongo/blob/master/src/mongo/db/exec/sbe/values/value.h#L208

 



 Comments   
Comment by Githook User [ 12/Dec/22 ]

Author:

{'name': 'Ivan Fefer', 'email': 'ivan.fefer@mongodb.com', 'username': 'Fefer-Ivan'}

Message: SERVER-72001 Fix type tag in traverseP_nested
Branch: master
https://github.com/mongodb/mongo/commit/efe614617eeb3b1362a233116bb8be138b5c64dd

Generated at Thu Feb 08 06:20:33 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.