Skip to content

CDRIVER-5834 Do not compare uninitialized bytes in _mongoc_server_description_equal #1814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Dec 18, 2024

Conversation

apolukhin
Copy link
Contributor

In mongoc_cluster_check_interval function the bson_error_t error; is constructed on the stack, its error message is not zero initialised

. In case of an error in mongoc_cluster_run_command_parts function, a short error message is written to error, leaving some of the bytes uninitialized. That error is then passed to mongoc_topology_description_invalidate_server
mongoc_topology_description_invalidate_server (tdmod.new_td, server_id, &error);
, which in turn copies the whole error message buffer into sd in mongoc_server_description_handle_hello
mongoc_server_description_handle_hello (sd, hello_response, rtt_msec, error);
, including uninitialized bytes
_mongoc_server_description_set_error (sd, error);

After that, attempt to call _mongoc_server_description_equal

sd_changed = !_mongoc_server_description_equal (prev_sd, sd);
results in comparison of uninitilized bytes of std->error at
if (0 != memcmp (&sd1->error, &sd2->error, sizeof (bson_error_t))) {

Resulting in sanitizer error:

Uninitialized bytes in MemcmpInterceptorCommon at offset 109 inside [0x71d0000200f8, 512)
==366158==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x9ac794 in bcmp /-S/contrib/libs/clang18-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:859:10
    #1 0x1dc3136 in _mongoc_server_description_equal /-S/contrib/libs/mongo-c-driver/libmongoc/src/mongoc/mongoc-server-description.c:1154:13
    #2 0x1de1ea0 in mongoc_topology_description_handle_hello /-S/contrib/libs/mongo-c-driver/libmongoc/src/mongoc/mongoc-topology-description.c:2204:21
    #3 0x1d867d7 in _mongoc_topology_update_no_lock /-S/contrib/libs/mongo-c-driver/libmongoc/src/mongoc/mongoc-topology.c:101:4
    #4 0x1d867d7 in _mongoc_topology_scanner_cb /-S/contrib/libs/mongo-c-driver/libmongoc/src/mongoc/mongoc-topology.c:188:7
    #5 0x1d9349d in _async_error_or_timeout /-S/contrib/libs/mongo-c-driver/libmongoc/src/mongoc/mongoc-topology-scanner.c:742:7
    #6 0x1d99b7d in mongoc_async_run /-S/contrib/libs/mongo-c-driver/libmongoc/src/mongoc/mongoc-async.c

In `mongoc_cluster_check_interval` function the `bson_error_t error;` is constructed on the stack, its error message is **not** zero initialised https://github.com/mongodb/mongo-c-driver/blob/db54ccf2fe10f6577cf17feae46f9448cd21f3a4/src/libmongoc/src/mongoc/mongoc-cluster.c#L2771. In case of an error in `mongoc_cluster_run_command_parts` function, a short error message is written to error, leaving some of the bytes uninitialized. That error is then passed to `mongoc_topology_description_invalidate_server` https://github.com/mongodb/mongo-c-driver/blob/db54ccf2fe10f6577cf17feae46f9448cd21f3a4/src/libmongoc/src/mongoc/mongoc-cluster.c#L2840 , which in turn copies the whole message into `sd` in mongoc_server_description_handle_hello https://github.com/mongodb/mongo-c-driver/blob/db54ccf2fe10f6577cf17feae46f9448cd21f3a4/src/libmongoc/src/mongoc/mongoc-topology-description.c#L2168, icluding uninitialized bytes https://github.com/mongodb/mongo-c-driver/blob/db54ccf2fe10f6577cf17feae46f9448cd21f3a4/src/libmongoc/src/mongoc/mongoc-server-description.c#L741

After that, attemtp to _mongoc_server_description_equal https://github.com/mongodb/mongo-c-driver/blob/db54ccf2fe10f6577cf17feae46f9448cd21f3a4/src/libmongoc/src/mongoc/mongoc-topology-description.c#L2204 results in comparison of uninitilized bytes of std->error at https://github.com/mongodb/mongo-c-driver/blob/db54ccf2fe10f6577cf17feae46f9448cd21f3a4/src/libmongoc/src/mongoc/mongoc-server-description.c#L1154
@apolukhin apolukhin changed the title Do not compare uninitialozed bytes in _mongoc_server_description_equal Do not compare uninitialized bytes in _mongoc_server_description_equal Dec 13, 2024
Copy link
Contributor

@eramongodb eramongodb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you very much for the contribution and the thorough PR description.

@kevinAlbs kevinAlbs changed the title Do not compare uninitialized bytes in _mongoc_server_description_equal CDRIVER-5834 Do not compare uninitialized bytes in _mongoc_server_description_equal Dec 16, 2024
Copy link
Collaborator

@kevinAlbs kevinAlbs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the fix!

@kevinAlbs kevinAlbs requested a review from eramongodb December 17, 2024 21:18
@kevinAlbs kevinAlbs merged commit 7c2300c into mongodb:master Dec 18, 2024
45 checks passed
kevinAlbs pushed a commit that referenced this pull request Dec 18, 2024
…cription_equal (#1814)

Fix possible comparison of uninitialized bytes in `bson_error_t`.

---------

Co-authored-by: Ezra Chung <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants