Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-12813

Overflow when converting double values in user input to long long values

    • Query Optimization
    • ALL
    • 0

      If 'batchSize' argument in cursor exceeds some value, it overflows, being considered negative.

      > use foo
      switched to db foo
      > var bigArray = [];
      > for (var i = 0; i < 1000; ++i) { bigArray.push(i); }
      1000
      > var bigStr = Array(1001).toString();
      > for (var i = 0; i < 100; ++i) { db.goo.insert({_id: i, bigArray: bigArray, bigStr: bigStr})};
      WriteResult({ "nInserted" : 1 })
      > var cursor = db.runCommand({aggregate: "goo", pipeline: [{$unwind:'$bigArray'}], cursor : {batchSize : Math.pow(2, 63)}})
      > cursor
      {
      	"errmsg" : "exception: Cursor batchSize must not be negative",
      	"code" : 16957,
      	"ok" : 0
      }
      > var cursor = db.runCommand({aggregate: "goo", pipeline: [{$unwind:'$bigArray'}], cursor : {batchSize : Math.pow(2, 62)}})
      > cursor
      {
      	"cursor" : {
      		"id" : NumberLong(0),
      		"ns" : "test.goo",
      		"firstBatch" : [ ..... ] 
      	},
      	"ok" : 1
      }
      
      > print(Math.pow(2, 63))
      9223372036854776000
      

            Assignee:
            backlog-query-optimization [DO NOT USE] Backlog - Query Optimization
            Reporter:
            davide.italiano Davide Italiano
            Votes:
            0 Vote for this issue
            Watchers:
            11 Start watching this issue

              Created:
              Updated: