Don't try to backfill more than 1.5M array elements SERVER-3750

2 files changed, 22 insertions, 0 deletions

diff --git a/bson/bsonobjbuilder.h b/bson/bsonobjbuilder.h
index f61d45879f3..86a52ac0cde 100644
--- a/bson/bsonobjbuilder.h
+++ b/bson/bsonobjbuilder.h
@@ -24,6 +24,7 @@
 
 #include <limits>
 #include <cmath>
+#include <boost/static_assert.hpp>
 #include "bsonelement.h"
 #include "bsonobj.h"
 #include "bsonmisc.h"
@@ -764,6 +765,11 @@ namespace mongo {
         }
 
         void fill (int upTo){
+            // if this is changed make sure to update error message and jstests/set7.js
+            const int maxElems = 1500000;
+            BOOST_STATIC_ASSERT(maxElems < (BSONObjMaxUserSize/10));
+            uassert(15891, "can't backfill array to larger than 1,500,000 elements", upTo <= maxElems);
+
             while( _i < upTo )
                 append( nullElt() );
         }
diff --git a/jstests/set7.js b/jstests/set7.js
index b46fe9eb51d..c6d311bc6d4 100644
--- a/jstests/set7.js
+++ b/jstests/set7.js
@@ -38,3 +38,19 @@ t.save( {a:[]} );
 t.update( {}, {$set:{"a.f":1}} );
 assert( db.getLastError() );
 assert.eq( [], t.findOne().a );
+
+// SERVER-3750
+t.drop();
+t.save( {a:[]} );
+t.update( {}, {$set:{"a.1500000":1}} ); // current limit
+assert( db.getLastError() == null );
+
+t.drop();
+t.save( {a:[]} );
+t.update( {}, {$set:{"a.1500001":1}} ); // 1 over limit
+assert.eq(15891 , db.getLastErrorObj().code );
+
+t.drop();
+t.save( {a:[]} );
+t.update( {}, {$set:{"a.1000000000":1}} ); // way over limit
+assert.eq(15891 , db.getLastErrorObj().code );