[SERVER-73534] Serialization of 'sbe::TypeTags::ArraySet' to 'KeyString' can segfault Created: 01/Feb/23 Updated: 29/Oct/23 Resolved: 03/Feb/23 |
|
| Status: | Closed |
| Project: | Core Server |
| Component/s: | Query Execution |
| Affects Version/s: | None |
| Fix Version/s: | 6.3.0-rc0, 6.0.5 |
| Type: | Bug | Priority: | Major - P3 |
| Reporter: | David Storch | Assignee: | David Storch |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||||||
| Backwards Compatibility: | Fully Compatible | ||||||||||||||||
| Operating System: | ALL | ||||||||||||||||
| Backport Requested: |
v6.0
|
||||||||||||||||
| Sprint: | QE 2023-02-06 | ||||||||||||||||
| Participants: | |||||||||||||||||
| Linked BF Score: | 164 | ||||||||||||||||
| Description |
|
This code is incorrect: In the case that the input tag indicates that the value is type Array, everything works as expected. When the value is an ArraySet, however, this code leads to undefined behavior. I've seen it consistently crash the server with a segfault in practice. The problem is that it calls getArrayView() on a value of type Array. This ends up interpreting the value as a pointer to an Array object when the value's actual runtime type is ArraySet. As soon as we try to access a data member of the pointed-to object, which happens here, we crash. The buggy function is used for spilling to disk in SBE's HashAggStage and HashLookupStage. Therefore, the crash can happen if we ever decide to spill an entry in the hash table whose key contains a value of type ArraySet. This is a somewhat unusual situation, since it requires the following:
This is a latent issue that was discovered our generational agg fuzzer. It was exposed due to the changes from |
| Comments |
| Comment by Githook User [ 06/Feb/23 ] |
|
Author: {'name': 'David Storch', 'email': 'david.storch@mongodb.com', 'username': 'dstorch'}Message: (cherry picked from commit 7d633d3c72a5cffb8889632e5cfb545002514ebb) |
| Comment by Githook User [ 03/Feb/23 ] |
|
Author: {'name': 'David Storch', 'email': 'david.storch@mongodb.com', 'username': 'dstorch'}Message: |