SBE traverseP_nested frees memory incorrectly if expression is invalid

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 6.3.0-rc0
    • Affects Version/s: None
    • Component/s: None
    • None
    • Fully Compatible
    • ALL
    • 135
    • None
    • 3
    • None
    • None
    • None
    • None
    • None
    • None

      It passes invalid tag type to the ValueGuard that is used only if expression fails

      https://github.com/mongodb/mongo/blob/master/src/mongo/db/exec/sbe/vm/vm.cpp#L1020

      It creates an array, but passes tag from input, which can be any of the following:
      https://github.com/mongodb/mongo/blob/master/src/mongo/db/exec/sbe/values/value.h#L208

       

            Assignee:
            Ivan Fefer
            Reporter:
            Ivan Fefer
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: