Fix unconditional access of unmocked mongoc_auto_encryption_opts_t fields#1573
Merged
eramongodb merged 1 commit intomongodb:masterfrom Feb 4, 2026
Merged
Conversation
kevinAlbs
approved these changes
Feb 4, 2026
Collaborator
kevinAlbs
left a comment
There was a problem hiding this comment.
Nice catch and analysis. LGTM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Followup to #1559, #1565, and #1566. In the end, the issue was indeed undefined behavior, not a codegen bug. The "bypass_auto_encryption" and "bypass_query_analysis" fields are not optional fields, instead defaulting to
false. These fields are unconditionally assigned to themongoc_auto_encryption_opts_tobject by the v1 API here, whereas in the v_noabi API, the object was only assigned when true. This is not an observable difference to end users, but it is very important for mock tests. The consequence is that when av1::clientorv1::poolobject is constructed with auto encryption opts, the unmocked mongoc setter functions were unconditionally invoked, thus accessing a non-existent object intended only for identity comparison, leading to stack variable out-of-bounds access. I suspect sanitizers did not catch this due to being invalid stack memory access, which they're not very good at diagnosing compared to other scenarios. This would result in the corruption of an unrelated but adjacent object such as one of the mock instances (opts_id,opts_destroy, etc.) or, in the other direction, one of theclient_mocks_typedata members, hence the segfaults on scope exit (destruction of a corrupted object). "Only on RHEL 8 ARM64" was probably due to stack variable layout determining which object is corrupted and how (circumstantially benign on most other platforms being tested). Rather than requiring mocks of unconditional fields, this PR proposing restoring the old behavior of only invoking the setter fortruevalues.