StringBuilder signed integer max buffer size spec is too low, can cause allocated memory buffer overflow upon call to BSONObj::toString()

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Done
    • Priority: Major - P3
    • 2.0.6, 2.1.0
    • Affects Version/s: None
    • Component/s: Stability
    • None
    • ALL
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None

      StringBuilder& operator<<( int x )

      { return SBNUM( x , 11 , "%d" ); }

      One of the longest signed integers is -2147483648, which is 11 bytes to print. And sprintf will add a null byte as a terminator, so 12 total bytes need to be allocated.

      I'd recommend checking the other max sizes passed to SBNUM and also switching to snprintf and checking its return value to ensure the 'n' limit isn't exceeded at runtime.

            Assignee:
            Eric Milkie
            Reporter:
            Aaron Staple (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: