The skip() and limit() values are passed as 32-bit signed integers in the OP_QUERY message of the wire protocol. This means that if you provide values which are too big, they can overflow and become negative.
For skip(), this isn't a problem because negative skip values are validated and rejected. For limit(), however, a negative limit has a special meaning and is accepted by the server. This means that large limit() values can overflow. The server shouldn't behave too badly in this case, but it does mean that the limit you get might be different from the limit you ask for. Can we add a warning that the behavior of limit is undefined for values outside of [-2^31, (2^31)-1] to this page: http://docs.mongodb.org/manual/reference/method/cursor.limit/?
- is related to
-
SERVER-13537 Large skip and and limit values can cause crash in blocking sort stage
- Closed