SERVER-17486 Crash when parsing invalid polygon coordinates

1 files changed, 21 insertions, 3 deletions

diff --git a/src/mongo/db/geo/geoparser.cpp b/src/mongo/db/geo/geoparser.cpp
index db03fe66c12..8b8c3aebb63 100644
--- a/src/mongo/db/geo/geoparser.cpp
+++ b/src/mongo/db/geo/geoparser.cpp
@@ -144,9 +144,15 @@ namespace mongo {
     }
 
     static Status isLoopClosed(const vector<S2Point>& loop, const BSONElement loopElt) {
-        if (loop.empty() || loop[0] != loop[loop.size() - 1])
-            return BAD_VALUE("Loop is not closed: " << loopElt.toString(false));
-        return Status::OK();
+      if (loop.empty()) {
+        return BAD_VALUE("Loop has no vertices: " << loopElt.toString(false));
+      }
+
+      if (loop[0] != loop[loop.size() - 1]) {
+        return BAD_VALUE("Loop is not closed: " << loopElt.toString(false));
+      }
+
+      return Status::OK();
     }
 
     static Status parseGeoJSONPolygonCoordinates(const BSONElement& elem, S2Polygon *out) {
@@ -173,6 +179,12 @@ namespace mongo {
             // Drop the duplicated last point.
             points.resize(points.size() - 1);
 
+            // At least 3 vertices.
+            if (points.size() < 3) {
+                return BAD_VALUE("Loop must have at least 3 different vertices: " <<
+                                 coordinateElt.toString(false));
+            }
+
             S2Loop* loop = new S2Loop(points);
             loops.push_back(loop);
 
@@ -269,6 +281,12 @@ namespace mongo {
         // duplicate points
         exteriorVertices.resize(exteriorVertices.size() - 1);
 
+        // At least 3 vertices.
+        if (exteriorVertices.size() < 3) {
+            return BAD_VALUE("Loop must have at least 3 different vertices: " <<
+                             elem.toString(false));
+        }
+
         auto_ptr<S2Loop> loop(new S2Loop(exteriorVertices));
         // Check whether this loop is valid.
         if (!loop->IsValid(&err)) {