-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Major - P3
-
None
-
Affects Version/s: 8.2.11
-
Component/s: None
-
Query Execution
-
ALL
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Hi,
I found that the following test case triggeres an integer overflow:
const dbName = "test"; const testDB = db.getSiblingDB(dbName); const coll = testDB.substr_bytes; testDB.dropDatabase(); coll.insertOne(\{_id: 1, s: "abc"}); const okResult = coll.aggregate([\{$project: {_id: 0, x: {$substrBytes: ["$s", NumberLong("9223372036854775807"), 1]}}}]).toArray(); print("NumberLong(max) result:"); printjson(okResult); let overflowErr = null; try { coll.aggregate([\{$project: {_id:0, x: {$substrBytes: ["$s", NumberDecimal("9223372036854775808"), 1]}}}]).toArray(); } catch (e) { overflowErr= \{code:e.code, message:e.message}; } print("NumberDecimal(max+1) error:"); printjson(overflowErr);
This is the output:
NumberLong(max) result:
[
{
x: ''
}
]
{
code: 50752,
message: 'Executor error during aggregate command on namespace: test.substr_bytes :: caused by :: $substrBytes: starting index must be non-negative (got: -9223372036854775808)'
}
NumberDecimal(max+1) error:
{
code: 50752,
message: 'Executor error during aggregate command on namespace: test.substr_bytes :: caused by :: $substrBytes: starting index must be non-negative (got: -9223372036854775808)'
}