SERVER-17040: NULL pointer crash in cloneCollectionAsCapped

2 files changed, 34 insertions, 0 deletions

diff --git a/jstests/core/clone_as_capped_nonexistant.js b/jstests/core/clone_as_capped_nonexistant.js
new file mode 100644
index 00000000000..9db9939b4b8
--- /dev/null
+++ b/jstests/core/clone_as_capped_nonexistant.js
@@ -0,0 +1,27 @@
+(function() {
+    "use strict";
+    // This test ensures that CloneCollectionAsCapped()ing a nonexistent collection will not
+    // cause the server to abort (SERVER-13750)
+
+    var dbname = "clone_collection_as_capped_nonexistent";
+    var testDb = db.getSiblingDB(dbname);
+    testDb.dropDatabase();
+
+    // Database does not exist here
+    var res = testDb.runCommand({cloneCollectionAsCapped: 'foo',
+                                 toCollection: 'bar',
+                                 size: 1024});
+    assert.eq(res.ok, 0, "cloning a nonexistent collection to capped should not have worked");
+    assert.eq(res.errmsg, "source database " + dbname + " does not exist",
+              "converting a nonexistent to capped failed but for the wrong reason");
+
+    // Database exists, but collection doesn't
+    testDb.coll.insert({});
+
+    var res = testDb.runCommand({cloneCollectionAsCapped: 'foo',
+                                 toCollection: 'bar',
+                                 size: 1024});
+    assert.eq(res.ok, 0, "cloning a nonexistent collection to capped should not have worked");
+    assert.eq(res.errmsg, "source collection " + dbname + ".foo does not exist",
+              "converting a nonexistent to capped failed but for the wrong reason");
+}());
diff --git a/src/mongo/db/commands/collection_to_capped.cpp b/src/mongo/db/commands/collection_to_capped.cpp
index 622fb39d41e..14e817840fa 100644
--- a/src/mongo/db/commands/collection_to_capped.cpp
+++ b/src/mongo/db/commands/collection_to_capped.cpp
@@ -184,6 +184,13 @@ namespace {
 
             Database* const db = autoDb.getDb();
 
+            if (!db) {
+                return appendCommandStatus(result,
+                                           Status(ErrorCodes::NamespaceNotFound,
+                                                  str::stream() << "source database "
+                                                  << dbname << " does not exist"));
+            }
+
             Status status = cloneCollectionAsCapped(txn, db, from, to, size, temp, true);
             return appendCommandStatus( result, status );
         }