From 6b748b2ccd5db6e60aaf1e3ede72a782ffa55dcd Mon Sep 17 00:00:00 2001
From: Dwight <dmerriman@gmail.com>
Date: Mon, 21 Sep 2009 10:40:25 -0400
Subject: validate skip() value on a query

---
 db/query.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/db/query.cpp b/db/query.cpp
index baa82c7102f..23f42683505 100644
--- a/db/query.cpp
+++ b/db/query.cpp
@@ -1121,7 +1121,9 @@ namespace mongo {
             saveClientCursor_(),
             findingStart_( (queryOptions & Option_OplogReplay) != 0 ),
             findingStartCursor_()
-        {}
+        {
+            uassert("bad skip value in query", ntoskip >= 0);
+        }
 
         virtual void init() {
             b_.skip( sizeof( QueryResult ) );
-- 
cgit v1.2.1