SERVER-16221 SERVER-23709 Fix out of bounds array access in ValueStorage dassert

1 files changed, 4 insertions, 3 deletions

diff --git a/src/mongo/db/pipeline/value.cpp b/src/mongo/db/pipeline/value.cpp
index cc35067b9da..be0d90af829 100644
--- a/src/mongo/db/pipeline/value.cpp
+++ b/src/mongo/db/pipeline/value.cpp
@@ -103,9 +103,10 @@ void ValueStorage::putString(StringData s) {
         shortStrSize = s.size();
         s.copyTo(shortStrStorage, false);  // no NUL
 
-        // All memory is zeroed before this is called.
-        // Note this may be past end of shortStrStorage and into nulTerminator
-        dassert(shortStrStorage[sizeNoNUL] == '\0');
+        // All memory is zeroed before this is called, so we know that
+        // the nulTerminator field will definitely contain a NUL byte.
+        dassert(((sizeNoNUL < sizeof(shortStrStorage)) && (shortStrStorage[sizeNoNUL] == '\0')) ||
+                (((shortStrStorage + sizeNoNUL) == &nulTerminator) && (nulTerminator == '\0')));
     } else {
         putRefCountable(RCString::create(s));
     }