-
Type:
Bug
-
Resolution: Incomplete
-
Priority:
Major - P3
-
None
-
Affects Version/s: None
-
Component/s: Querying
-
None
-
ALL
-
None
-
None
-
None
-
None
-
None
-
None
-
None
The code for checking the size of the $in bounds set product doesn't handle an integer overflow.
t = db.jstests_inc;
t.drop();
t.save( {} );
inValues = [];
for( i = 0; i < 256; ++i ) {
inValues.push( i );
}
index = {};
query = {};
for( i = 0; i < 8; ++i ) {
index[ '' + i ] = 1;
query[ '' + i ] = { $in:inValues };
}
t.ensureIndex( index );
assert.throws( function() { t.find( query ).hint( index ).itcount(); } );