SERVER-42110 uassert that the integer part of a v0 numeric KeyString value is less than 2^53

(cherry picked from commit f60d85ed3082778dd4bacd9f555648215cce7d48)

2 files changed, 24 insertions, 0 deletions

diff --git a/src/mongo/db/storage/key_string.cpp b/src/mongo/db/storage/key_string.cpp
index a7fab7792c3..6a279990fb6 100644
--- a/src/mongo/db/storage/key_string.cpp
+++ b/src/mongo/db/storage/key_string.cpp
@@ -1600,6 +1600,10 @@ void toBsonValue(uint8_t ctype,
                 uassert(50832,
                         "Expected type double for fractional part.",
                         originalType == TypeBits::kDouble);
+                uassert(31209,
+                        "Integer part is too big to be a double.",
+                        integerPart < kMaxIntForDouble);
+
                 const uint64_t exponent = (64 - countLeadingZeros64(integerPart)) - 1;
                 const size_t fractionalBits = (52 - exponent);
                 const size_t fractionalBytes = (fractionalBits + 7) / 8;
diff --git a/src/mongo/db/storage/key_string_test.cpp b/src/mongo/db/storage/key_string_test.cpp
index 57ce40f4563..f5f8b50c47c 100644
--- a/src/mongo/db/storage/key_string_test.cpp
+++ b/src/mongo/db/storage/key_string_test.cpp
@@ -458,6 +458,26 @@ TEST_F(KeyStringTest, DecimalNumbers) {
     ROUNDTRIP(V1, BSON("" << BSONNULL << "" << BSON("a" << Decimal128::kPositiveInfinity)));
 }
 
+TEST_F(KeyStringTest, DoubleInvalidIntegerPartV0) {
+    // Test that an illegally encoded double throws an error.
+    const char* data =
+        // kNumericPositive7ByteInt
+        "\x31"
+        // Encode a 1 bit at the lowest end to indicate that this number has a fractional part.
+        // Then add the value 1 << 53 left-shifted by 1. 1 << 53 is too large to have been encoded
+        // as a  double, and will cause the call to toBsonSafe to fail.
+        "\x40\x00\x00\x00\x00\x00\x01";  // ((1 << 53) << 1) + 1
+    const size_t size = 8;
+
+    mongo::KeyString::TypeBits tb(mongo::KeyString::Version::V0);
+    tb.appendNumberDouble();
+
+    ASSERT_THROWS_CODE(
+        mongo::KeyString::toBsonSafe(data, size, mongo::Ordering::make(mongo::BSONObj()), tb),
+        AssertionException,
+        31209);
+}
+
 TEST_F(KeyStringTest, LotsOfNumbers1) {
     for (int i = 0; i < 64; i++) {
         int64_t x = 1LL << i;