Skip to content

Commit aadf9bc

Browse files
jmikolaajdavis
authored andcommitted
CDRIVER-2072: Always initialize cursor filter and opts
mongoc_cursor_destroy() always attempts to destroy these documents, which would previously crash if they were left uninitialized when an error was reported by _mongoc_cursor_new_with_opts().
1 parent 3aa053d commit aadf9bc

File tree

2 files changed

+76
-5
lines changed

2 files changed

+76
-5
lines changed

src/mongoc/mongoc-cursor.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,9 @@ _mongoc_cursor_new_with_opts (mongoc_client_t *client,
229229
cursor->client = client;
230230
cursor->is_command = is_command ? 1 : 0;
231231

232+
bson_init (&cursor->filter);
233+
bson_init (&cursor->opts);
234+
232235
if (filter) {
233236
if (!bson_validate (filter, BSON_VALIDATE_EMPTY_KEYS, NULL)) {
234237
MARK_FAILED (cursor);
@@ -239,9 +242,8 @@ _mongoc_cursor_new_with_opts (mongoc_client_t *client,
239242
GOTO (finish);
240243
}
241244

245+
bson_destroy (&cursor->filter);
242246
bson_copy_to (filter, &cursor->filter);
243-
} else {
244-
bson_init (&cursor->filter);
245247
}
246248

247249
if (opts) {
@@ -263,7 +265,6 @@ _mongoc_cursor_new_with_opts (mongoc_client_t *client,
263265
GOTO (finish);
264266
}
265267

266-
bson_init (&cursor->opts);
267268
bson_copy_to_excluding_noinit (opts, &cursor->opts, "serverId", NULL);
268269

269270
/* true if there's a valid serverId or no serverId, false on err */
@@ -279,8 +280,6 @@ _mongoc_cursor_new_with_opts (mongoc_client_t *client,
279280
if (server_id) {
280281
mongoc_cursor_set_hint (cursor, server_id);
281282
}
282-
} else {
283-
bson_init (&cursor->opts);
284283
}
285284

286285
cursor->read_prefs = read_prefs

tests/test-mongoc-cursor.c

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -733,6 +733,74 @@ test_cursor_new_invalid (void)
733733
mongoc_client_destroy (client);
734734
}
735735

736+
737+
static void
738+
test_cursor_new_invalid_filter (void)
739+
{
740+
mongoc_client_t *client;
741+
mongoc_collection_t *collection;
742+
mongoc_cursor_t *cursor;
743+
bson_error_t error;
744+
745+
client = test_framework_client_new ();
746+
collection = mongoc_client_get_collection (client, "test", "test");
747+
748+
cursor = mongoc_collection_find_with_opts (
749+
collection, tmp_bson ("{'': 1}"), NULL, NULL);
750+
751+
ASSERT (cursor);
752+
ASSERT (mongoc_cursor_error (cursor, &error));
753+
ASSERT_ERROR_CONTAINS (error,
754+
MONGOC_ERROR_CURSOR,
755+
MONGOC_ERROR_CURSOR_INVALID_CURSOR,
756+
"Empty keys are not allowed in 'filter'.");
757+
758+
mongoc_cursor_destroy (cursor);
759+
mongoc_collection_destroy (collection);
760+
mongoc_client_destroy (client);
761+
}
762+
763+
764+
static void
765+
test_cursor_new_invalid_opts (void)
766+
{
767+
mongoc_client_t *client;
768+
mongoc_collection_t *collection;
769+
mongoc_cursor_t *cursor;
770+
bson_error_t error;
771+
772+
client = test_framework_client_new ();
773+
collection = mongoc_client_get_collection (client, "test", "test");
774+
775+
cursor = mongoc_collection_find_with_opts (
776+
collection, tmp_bson (NULL), tmp_bson ("{'projection': {'': 1}}"), NULL);
777+
778+
ASSERT (cursor);
779+
ASSERT (mongoc_cursor_error (cursor, &error));
780+
ASSERT_ERROR_CONTAINS (error,
781+
MONGOC_ERROR_CURSOR,
782+
MONGOC_ERROR_CURSOR_INVALID_CURSOR,
783+
"Cannot use empty keys in 'opts'.");
784+
785+
mongoc_cursor_destroy (cursor);
786+
787+
cursor = mongoc_collection_find_with_opts (
788+
collection, tmp_bson (NULL), tmp_bson ("{'$invalid': 1}"), NULL);
789+
790+
ASSERT (cursor);
791+
ASSERT (mongoc_cursor_error (cursor, &error));
792+
ASSERT_ERROR_CONTAINS (error,
793+
MONGOC_ERROR_CURSOR,
794+
MONGOC_ERROR_CURSOR_INVALID_CURSOR,
795+
"Cannot use $-modifiers in 'opts'.");
796+
797+
mongoc_cursor_destroy (cursor);
798+
799+
mongoc_collection_destroy (collection);
800+
mongoc_client_destroy (client);
801+
}
802+
803+
736804
static void
737805
test_cursor_new_static (void)
738806
{
@@ -1592,6 +1660,10 @@ test_cursor_install (TestSuite *suite)
15921660
NULL,
15931661
test_framework_skip_if_max_wire_version_less_than_4);
15941662
TestSuite_AddLive (suite, "/Cursor/new_invalid", test_cursor_new_invalid);
1663+
TestSuite_AddLive (
1664+
suite, "/Cursor/new_invalid_filter", test_cursor_new_invalid_filter);
1665+
TestSuite_AddLive (
1666+
suite, "/Cursor/new_invalid_opts", test_cursor_new_invalid_opts);
15951667
TestSuite_AddLive (suite, "/Cursor/new_static", test_cursor_new_static);
15961668
TestSuite_AddLive (suite, "/Cursor/hint/errors", test_cursor_hint_errors);
15971669
TestSuite_Add (

0 commit comments

Comments
 (0)