diff options
| author | Sara Golemon <sara.golemon@mongodb.com> | 2019-08-19 21:46:30 +0000 |
|---|---|---|
| committer | evergreen <evergreen@mongodb.com> | 2019-08-19 21:46:30 +0000 |
| commit | 0968b339c18872e9b689b5ec70ba76f166a9e4f5 (patch) | |
| tree | d26f07a82855d59cbc2c8662adaf440e9c371a66 /src | |
| parent | 4d59f45f85919ddaffa260fb76d1e7dbd8950edf (diff) | |
| download | mongo-0968b339c18872e9b689b5ec70ba76f166a9e4f5.tar.gz | |
SERVER-42853 Check cursor count bounds before validating size
Diffstat (limited to 'src')
| -rw-r--r-- | src/mongo/db/service_entry_point_common.cpp | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/src/mongo/db/service_entry_point_common.cpp b/src/mongo/db/service_entry_point_common.cpp index a671f97e4cd..a4117d0bd56 100644 --- a/src/mongo/db/service_entry_point_common.cpp +++ b/src/mongo/db/service_entry_point_common.cpp @@ -1087,19 +1087,18 @@ void receivedKillCursors(OperationContext* opCtx, const Message& m) { DbMessage dbmessage(m); int n = dbmessage.pullInt(); + if (n > 2000) { + (n < 30000 ? warning() : error()) << "receivedKillCursors, n=" << n; + verify(n < 30000); + } + uassert(13659, "sent 0 cursors to kill", n != 0); massert(13658, str::stream() << "bad kill cursors size: " << m.dataSize(), m.dataSize() == 8 + (8 * n)); uassert(13004, str::stream() << "sent negative cursors to kill: " << n, n >= 1); - if (n > 2000) { - (n < 30000 ? warning() : error()) << "receivedKillCursors, n=" << n; - verify(n < 30000); - } - const char* cursorArray = dbmessage.getArray(n); - int found = runOpKillCursors(opCtx, static_cast<size_t>(n), cursorArray); if (shouldLog(logger::LogSeverity::Debug(1)) || found != n) { |