SERVER-45920 Validate writeConcern.w

1 files changed, 9 insertions, 1 deletions

diff --git a/src/mongo/db/write_concern_options.cpp b/src/mongo/db/write_concern_options.cpp
index 80e1c8bd0e4..f24ec703469 100644
--- a/src/mongo/db/write_concern_options.cpp
+++ b/src/mongo/db/write_concern_options.cpp
@@ -35,6 +35,7 @@
 #include "mongo/base/string_data.h"
 #include "mongo/bson/util/bson_extract.h"
 #include "mongo/db/field_parser.h"
+#include "mongo/db/repl/repl_set_config.h"
 #include "mongo/util/str.h"
 
 namespace mongo {
@@ -151,7 +152,14 @@ StatusWith<WriteConcernOptions> WriteConcernOptions::parse(const BSONObj& obj) {
     }
 
     if (wEl.isNumber()) {
-        writeConcern.wNumNodes = wEl.numberInt();
+        auto wNumNodes = wEl.safeNumberLong();
+        if (wNumNodes < 0 ||
+            wNumNodes > static_cast<decltype(wNumNodes)>(repl::ReplSetConfig::kMaxMembers)) {
+            return Status(ErrorCodes::FailedToParse,
+                          str::stream() << "w has to be a non-negative number and not greater than "
+                                        << repl::ReplSetConfig::kMaxMembers);
+        }
+        writeConcern.wNumNodes = static_cast<decltype(writeConcern.wNumNodes)>(wNumNodes);
         writeConcern.usedDefaultW = false;
     } else if (wEl.type() == String) {
         writeConcern.wNumNodes = 0;