SERVER-33078 convertToCapped size is not checked for float -> long long overflow

4 files changed, 29 insertions, 5 deletions

diff --git a/jstests/core/convert_to_capped.js b/jstests/core/convert_to_capped.js
new file mode 100644
index 00000000000..a27596e79b3
--- /dev/null
+++ b/jstests/core/convert_to_capped.js
@@ -0,0 +1,22 @@
+// Test the convertToCapped cmd.
+//
+// @tags: [requires_non_retryable_commands]
+
+(function() {
+    "use strict";
+
+    let testDb = db.getSiblingDB("convert_to_capped");
+    let coll = testDb.coll;
+    testDb.dropDatabase();
+
+    // Create a collection with some data.
+    let num = 10;
+    for (let i = 0; i < num; ++i) {
+        assert.writeOK(coll.insert({_id: i}));
+    }
+
+    // Ensure we do not allow overflowing the size long long on the server (SERVER-33078).
+    assert.commandFailedWithCode(
+        testDb.runCommand({convertToCapped: coll.getName(), size: 5308156746568725891247}),
+        ErrorCodes.BadValue);
+})();
diff --git a/src/mongo/db/catalog/capped_utils.cpp b/src/mongo/db/catalog/capped_utils.cpp
index 47a5b0a3dd2..d89fcfe4177 100644
--- a/src/mongo/db/catalog/capped_utils.cpp
+++ b/src/mongo/db/catalog/capped_utils.cpp
@@ -113,7 +113,7 @@ mongo::Status mongo::cloneCollectionAsCapped(OperationContext* opCtx,
                                              Database* db,
                                              const std::string& shortFrom,
                                              const std::string& shortTo,
-                                             double size,
+                                             long long size,
                                              bool temp) {
     NamespaceString fromNss(db->name(), shortFrom);
     NamespaceString toNss(db->name(), shortTo);
@@ -251,7 +251,7 @@ mongo::Status mongo::cloneCollectionAsCapped(OperationContext* opCtx,
 
 mongo::Status mongo::convertToCapped(OperationContext* opCtx,
                                      const NamespaceString& collectionName,
-                                     double size) {
+                                     long long size) {
     StringData dbname = collectionName.db();
     StringData shortSource = collectionName.coll();
 
diff --git a/src/mongo/db/catalog/capped_utils.h b/src/mongo/db/catalog/capped_utils.h
index 9ae6a41c505..9f8bbdb962b 100644
--- a/src/mongo/db/catalog/capped_utils.h
+++ b/src/mongo/db/catalog/capped_utils.h
@@ -45,11 +45,13 @@ Status cloneCollectionAsCapped(OperationContext* opCtx,
                                Database* db,
                                const std::string& shortFrom,
                                const std::string& shortTo,
-                               double size,
+                               long long size,
                                bool temp);
 
 /**
  * Converts the collection "collectionName" to a capped collection with a size of "size".
  */
-Status convertToCapped(OperationContext* opCtx, const NamespaceString& collectionName, double size);
+Status convertToCapped(OperationContext* opCtx,
+                       const NamespaceString& collectionName,
+                       long long size);
 }  // namespace mongo
diff --git a/src/mongo/db/commands/collection_to_capped.cpp b/src/mongo/db/commands/collection_to_capped.cpp
index 4820dc1608f..f01372fb2d7 100644
--- a/src/mongo/db/commands/collection_to_capped.cpp
+++ b/src/mongo/db/commands/collection_to_capped.cpp
@@ -171,7 +171,7 @@ public:
                    string& errmsg,
                    BSONObjBuilder& result) {
         const NamespaceString nss(CommandHelpers::parseNsCollectionRequired(dbname, jsobj));
-        double size = jsobj.getField("size").number();
+        long long size = jsobj.getField("size").safeNumberLong();
 
         if (size == 0) {
             errmsg = "invalid command spec";