Merge branch 'master' of ssh://git.10gen.com/data/gitroot/p

1 files changed, 10 insertions, 1 deletions

diff --git a/db/matcher.cpp b/db/matcher.cpp
index 8a4c74a333b..14100030e98 100644
--- a/db/matcher.cpp
+++ b/db/matcher.cpp
@@ -200,12 +200,19 @@ JSMatcher::JSMatcher(JSObj &_jsobj) :
 						if( fn[1] == 'g' ) { 
 							if( fn[3] == 0 ) op = GT;
 							else if( fn[3] == 'e' && fn[4] == 0 ) op = GTE;
+							else
+							  uassert("invalid $operator", false);
 						}
 						else if( fn[1] == 'l' ) { 
 							if( fn[3] == 0 ) op = LT;
 							else if( fn[3] == 'e' && fn[4] == 0 ) op = LTE;
+							else
+							  uassert("invalid $operator", false);
 						}
-						if( op && nBuilders < 8) { 
+						else
+						  uassert("invalid $operator", false);
+						if( op ) {
+						  uassert("too many items to match in query", nBuilders < 8);
 							JSObjBuilder *b = new JSObjBuilder();
 							builders[nBuilders++] = b;
 							b->appendAs(fe, e.fieldName());
@@ -237,6 +244,8 @@ JSMatcher::JSMatcher(JSObj &_jsobj) :
 						n++;
 						ok = true;
 					}
+					else
+					  uassert("invalid $operator", false);
 				}
 				else {
 					ok = false;