Uploaded image for project: 'C Driver'
  1. C Driver
  2. CDRIVER-2860

Client created after mongoc_cleanup sends garbage handshake metadata

    • Type: Icon: Bug Bug
    • Resolution: Won't Fix
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: 1.5.0
    • Component/s: libmongoc
    • None

      It's well-documented that applications must call mongoc_init once at the beginning and mongoc_cleanup once at the end. If an application is written incorrectly, interesting things can happen:

      /* allocates metadata values */
      mongoc_init ();
      /* frees metadata values */
      mongoc_cleanup ();
      /* no effect */
      mongoc_init ();
      /* involves allocations, maybe overwrites metadata values */
      client = mongoc_client_new ("mongodb://user:pass@localhost");
      

      The first call to mongoc_init allocates the handshake metadata values such as the driver name, and the first call to mongoc_cleanup frees these values. After that, subsequent calls to mongoc_init and mongoc_cleanup do nothing, by design.

      However, creating a mongoc_client_t after mongoc_cleanup uses the metadata values, even though they were freed by mongoc_cleanup. Since they're freed, they may be overwritten by some future memory allocation. It's unpredictable what data will be written there and used as the metadata.

      With code like the above, I produced a garbage handshake, including a scrap of the URI, since the driver allocates space for a copy of the URI after mongoc_cleanup, and the space previously occupied by the handshake metadata is reused for the URI copy.

            Assignee:
            jesse@mongodb.com A. Jesse Jiryu Davis
            Reporter:
            jesse@mongodb.com A. Jesse Jiryu Davis
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: