Details
-
Bug
-
Resolution: Incomplete
-
Major - P3
-
None
-
None
-
None
-
ALL
Description
The code for checking the size of the $in bounds set product doesn't handle an integer overflow.
|
|
t = db.jstests_inc;
|
t.drop();
|
|
|
t.save( {} );
|
|
|
inValues = [];
|
for( i = 0; i < 256; ++i ) {
|
inValues.push( i );
|
}
|
|
|
index = {};
|
query = {};
|
for( i = 0; i < 8; ++i ) {
|
index[ '' + i ] = 1;
|
query[ '' + i ] = { $in:inValues };
|
}
|
t.ensureIndex( index );
|
|
|
assert.throws( function() { t.find( query ).hint( index ).itcount(); } );
|
|
|