SERVER-25312 Check for Null embedded malformed config string

(cherry picked from commit 160344c5862ce31097253ebe55307d44c074e674)

2 files changed, 65 insertions, 0 deletions

diff --git a/jstests/noPassthrough/wt_malformed_creation_string.js b/jstests/noPassthrough/wt_malformed_creation_string.js
new file mode 100644
index 00000000000..4067cca329f
--- /dev/null
+++ b/jstests/noPassthrough/wt_malformed_creation_string.js
@@ -0,0 +1,60 @@
+/**
+ * Tests that a null embedded malformed string is rejected gracefully.
+ */
+(function() {
+    'use strict';
+
+    var engine = 'wiredTiger';
+    if (jsTest.options().storageEngine) {
+        engine = jsTest.options().storageEngine;
+    }
+
+    // Skip this test if not running with the right storage engine.
+    if (engine !== 'wiredTiger' && engine !== 'inMemory') {
+        jsTest.log('Skipping test because storageEngine is not "wiredTiger" or "inMemory"');
+        return;
+    }
+
+    // Build an array of malformed strings to test
+    var malformedStrings = ["\u0000000", "\0,", "bl\0ah", "split_pct=30,\0split_pct=35,"];
+
+    // Start up a mongod.
+    // Test that collection and index creation with malformed creation strings fail gracefully.
+    runTest();
+
+    function runTest() {
+        var dbpath = MongoRunner.dataPath + 'wt_malformed_creation_string';
+        resetDbpath(dbpath);
+
+        // Start a mongod
+        var conn = MongoRunner.runMongod({
+            dbpath: dbpath,
+            noCleanData: true,
+        });
+        assert.neq(null, conn, 'mongod was unable to start up');
+
+        var testDB = conn.getDB('test');
+
+        // Collection creation with malformed string should fail
+        for (var i = 0; i < malformedStrings.length; i++) {
+            assert.commandFailedWithCode(
+                testDB.createCollection(
+                    'coll', {storageEngine: {[engine]: {configString: malformedStrings[i]}}}),
+                ErrorCodes.FailedToParse);
+        }
+
+        // Create collection to test index creation on
+        assert.commandWorked(testDB.createCollection('coll'));
+
+        // Index creation with malformed string should fail
+        for (var i = 0; i < malformedStrings.length; i++) {
+            assert.commandFailedWithCode(testDB.coll.createIndex({a: 1}, {
+                name: 'with_malformed_str',
+                storageEngine: {[engine]: {configString: malformedStrings[i]}}
+            }),
+                                         ErrorCodes.FailedToParse);
+        }
+
+        MongoRunner.stopMongod(conn);
+    }
+})();
diff --git a/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp b/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
index c1ce6ac0c35..b840815e3a5 100644
--- a/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
+++ b/src/mongo/db/storage/wiredtiger/wiredtiger_util.cpp
@@ -251,6 +251,11 @@ Status WiredTigerUtil::checkTableCreationOptions(const BSONElement& configElem)
     ErrorAccumulator eventHandler(&errors);
 
     StringData config = configElem.valueStringData();
+    // Do NOT allow embedded null characters
+    if (config.size() != strlen(config.rawData())) {
+        return {ErrorCodes::FailedToParse, "malformed 'configString' value."};
+    }
+
     Status status = wtRCToStatus(
         wiredtiger_config_validate(nullptr, &eventHandler, "WT_SESSION.create", config.rawData()));
     if (!status.isOK()) {