diff options
author | Louis Williams <louis.williams@mongodb.com> | 2019-07-26 14:48:59 -0400 |
---|---|---|
committer | Louis Williams <louis.williams@mongodb.com> | 2019-07-26 14:48:59 -0400 |
commit | 7b40c78e0eb5fe9a569d5273826da98ea38968ed (patch) | |
tree | 600bcfceeb471ff07a34def90673e3ef6d1a416d | |
parent | 05dd2382484e10b53428af57c1cb7396497ad628 (diff) | |
download | mongo-7b40c78e0eb5fe9a569d5273826da98ea38968ed.tar.gz |
SERVER-42110 uassert that the integer part of a v0 numeric KeyString value is less than 2^53
(cherry picked from commit f60d85ed3082778dd4bacd9f555648215cce7d48)
-rw-r--r-- | src/mongo/db/storage/key_string.cpp | 4 | ||||
-rw-r--r-- | src/mongo/db/storage/key_string_test.cpp | 20 |
2 files changed, 24 insertions, 0 deletions
diff --git a/src/mongo/db/storage/key_string.cpp b/src/mongo/db/storage/key_string.cpp index a7fab7792c3..6a279990fb6 100644 --- a/src/mongo/db/storage/key_string.cpp +++ b/src/mongo/db/storage/key_string.cpp @@ -1600,6 +1600,10 @@ void toBsonValue(uint8_t ctype, uassert(50832, "Expected type double for fractional part.", originalType == TypeBits::kDouble); + uassert(31209, + "Integer part is too big to be a double.", + integerPart < kMaxIntForDouble); + const uint64_t exponent = (64 - countLeadingZeros64(integerPart)) - 1; const size_t fractionalBits = (52 - exponent); const size_t fractionalBytes = (fractionalBits + 7) / 8; diff --git a/src/mongo/db/storage/key_string_test.cpp b/src/mongo/db/storage/key_string_test.cpp index 57ce40f4563..f5f8b50c47c 100644 --- a/src/mongo/db/storage/key_string_test.cpp +++ b/src/mongo/db/storage/key_string_test.cpp @@ -458,6 +458,26 @@ TEST_F(KeyStringTest, DecimalNumbers) { ROUNDTRIP(V1, BSON("" << BSONNULL << "" << BSON("a" << Decimal128::kPositiveInfinity))); } +TEST_F(KeyStringTest, DoubleInvalidIntegerPartV0) { + // Test that an illegally encoded double throws an error. + const char* data = + // kNumericPositive7ByteInt + "\x31" + // Encode a 1 bit at the lowest end to indicate that this number has a fractional part. + // Then add the value 1 << 53 left-shifted by 1. 1 << 53 is too large to have been encoded + // as a double, and will cause the call to toBsonSafe to fail. + "\x40\x00\x00\x00\x00\x00\x01"; // ((1 << 53) << 1) + 1 + const size_t size = 8; + + mongo::KeyString::TypeBits tb(mongo::KeyString::Version::V0); + tb.appendNumberDouble(); + + ASSERT_THROWS_CODE( + mongo::KeyString::toBsonSafe(data, size, mongo::Ordering::make(mongo::BSONObj()), tb), + AssertionException, + 31209); +} + TEST_F(KeyStringTest, LotsOfNumbers1) { for (int i = 0; i < 64; i++) { int64_t x = 1LL << i; |