diff options
author | Dianna Hohensee <dianna.hohensee@10gen.com> | 2018-05-25 14:52:05 -0400 |
---|---|---|
committer | Dianna Hohensee <dianna.hohensee@10gen.com> | 2018-06-04 08:26:58 -0400 |
commit | f527188c4dab4bf2a3ce0e31406dbd121c3a90ca (patch) | |
tree | 62e3f480eefaf2d8afca0e19c54679eefc5e5522 | |
parent | 3d62f3cd3744f4e71fde117f35d51df5c47f33d7 (diff) | |
download | mongo-f527188c4dab4bf2a3ce0e31406dbd121c3a90ca.tar.gz |
SERVER-33078 convertToCapped size is not checked for float -> long long overflow
-rw-r--r-- | jstests/core/convert_to_capped.js | 22 | ||||
-rw-r--r-- | src/mongo/db/catalog/capped_utils.cpp | 4 | ||||
-rw-r--r-- | src/mongo/db/catalog/capped_utils.h | 6 | ||||
-rw-r--r-- | src/mongo/db/commands/collection_to_capped.cpp | 2 |
4 files changed, 29 insertions, 5 deletions
diff --git a/jstests/core/convert_to_capped.js b/jstests/core/convert_to_capped.js new file mode 100644 index 00000000000..a27596e79b3 --- /dev/null +++ b/jstests/core/convert_to_capped.js @@ -0,0 +1,22 @@ +// Test the convertToCapped cmd. +// +// @tags: [requires_non_retryable_commands] + +(function() { + "use strict"; + + let testDb = db.getSiblingDB("convert_to_capped"); + let coll = testDb.coll; + testDb.dropDatabase(); + + // Create a collection with some data. + let num = 10; + for (let i = 0; i < num; ++i) { + assert.writeOK(coll.insert({_id: i})); + } + + // Ensure we do not allow overflowing the size long long on the server (SERVER-33078). + assert.commandFailedWithCode( + testDb.runCommand({convertToCapped: coll.getName(), size: 5308156746568725891247}), + ErrorCodes.BadValue); +})(); diff --git a/src/mongo/db/catalog/capped_utils.cpp b/src/mongo/db/catalog/capped_utils.cpp index 47a5b0a3dd2..d89fcfe4177 100644 --- a/src/mongo/db/catalog/capped_utils.cpp +++ b/src/mongo/db/catalog/capped_utils.cpp @@ -113,7 +113,7 @@ mongo::Status mongo::cloneCollectionAsCapped(OperationContext* opCtx, Database* db, const std::string& shortFrom, const std::string& shortTo, - double size, + long long size, bool temp) { NamespaceString fromNss(db->name(), shortFrom); NamespaceString toNss(db->name(), shortTo); @@ -251,7 +251,7 @@ mongo::Status mongo::cloneCollectionAsCapped(OperationContext* opCtx, mongo::Status mongo::convertToCapped(OperationContext* opCtx, const NamespaceString& collectionName, - double size) { + long long size) { StringData dbname = collectionName.db(); StringData shortSource = collectionName.coll(); diff --git a/src/mongo/db/catalog/capped_utils.h b/src/mongo/db/catalog/capped_utils.h index 9ae6a41c505..9f8bbdb962b 100644 --- a/src/mongo/db/catalog/capped_utils.h +++ b/src/mongo/db/catalog/capped_utils.h @@ -45,11 +45,13 @@ Status cloneCollectionAsCapped(OperationContext* opCtx, Database* db, const std::string& shortFrom, const std::string& shortTo, - double size, + long long size, bool temp); /** * Converts the collection "collectionName" to a capped collection with a size of "size". */ -Status convertToCapped(OperationContext* opCtx, const NamespaceString& collectionName, double size); +Status convertToCapped(OperationContext* opCtx, + const NamespaceString& collectionName, + long long size); } // namespace mongo diff --git a/src/mongo/db/commands/collection_to_capped.cpp b/src/mongo/db/commands/collection_to_capped.cpp index 4820dc1608f..f01372fb2d7 100644 --- a/src/mongo/db/commands/collection_to_capped.cpp +++ b/src/mongo/db/commands/collection_to_capped.cpp @@ -171,7 +171,7 @@ public: string& errmsg, BSONObjBuilder& result) { const NamespaceString nss(CommandHelpers::parseNsCollectionRequired(dbname, jsobj)); - double size = jsobj.getField("size").number(); + long long size = jsobj.getField("size").safeNumberLong(); if (size == 0) { errmsg = "invalid command spec"; |