Fix unbounded sorted-query allocation

Start the top-k heap with a small capacity so an effectively unlimited wire-protocol limit does not reserve gigabytes before reading any documents. Add regression coverage for the maximum default limit and document the fix.

Thanks to jeremy-arsia and xet7 !

Fixes wekan/wekan#6666,

Author: xet7

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 <!-- markdownlint-disable MD024 MD034 -->
 
+## Upcoming FerretDB release
+
+### Fixed 🐛
+
+- **Sorted queries with an effectively unlimited result limit no longer reserve
+  memory for every possible result before reading the first document.** The
+  bounded top-k heap now starts with a small capacity and grows only for rows
+  that actually exist, preventing ordinary client queries from attempting a
+  multi-gigabyte allocation and taking down the database. Positive coverage
+  verifies correct ordering with the wire protocol's maximum default limit,
+  while the existing finite-limit test retains bounded top-k behavior by
+  @xet7. Thanks to jeremy-arsia, Heart1010 and xet7.
+
 ## [v1.64.0](https://github.com/wekan/FerretDB/releases/tag/v1.64.0) (2026-08-30)
 
 ### Fixed 🐛

internal/handler/common/sort_iterator.go

@@ -24,6 +24,11 @@ import (
 	"github.com/FerretDB/FerretDB/internal/util/lazyerrors"
 )
 
+// sortLimitInitialCapacity keeps an effectively unlimited wire-protocol limit
+// from becoming a multi-gigabyte allocation before the first document is read.
+// The slice still grows normally when the result set actually contains more.
+const sortLimitInitialCapacity int64 = 1024
+
 // SortIterator returns an iterator of sorted documents.
 // It will be added to the given closer.
 //
@@ -62,7 +67,8 @@ func SortLimitIterator(iter types.DocumentsIterator, closer *iterator.MultiClose
 		return nil, lazyerrors.Error(err)
 	}
 
-	h := &documentsMaxHeap{sorts: sorts, docs: make([]*types.Document, 0, keep)}
+	capacity := min(keep, sortLimitInitialCapacity)
+	h := &documentsMaxHeap{sorts: sorts, docs: make([]*types.Document, 0, capacity)}
 	heap.Init(h)
 	for {
 		_, doc, nextErr := iter.Next()

internal/handler/common/sort_limit_iterator_test.go

@@ -6,6 +6,7 @@
 package common
 
 import (
+	"math"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -42,3 +43,25 @@ func TestSortLimitIterator(t *testing.T) {
 		must.NotFail(actual[2].Get("_id")).(string),
 	})
 }
+
+func TestSortLimitIteratorEffectivelyUnlimited(t *testing.T) {
+	t.Parallel()
+
+	docs := []*types.Document{
+		must.NotFail(types.NewDocument("_id", "two", "sort", int32(2))),
+		must.NotFail(types.NewDocument("_id", "one", "sort", int32(1))),
+	}
+	sortDoc := must.NotFail(types.NewDocument("sort", int32(1)))
+	closer := iterator.NewMultiCloser()
+	defer closer.Close()
+	source := iterator.Values(iterator.ForSlice(docs))
+	closer.Add(source)
+
+	limited, err := SortLimitIterator(source, closer, sortDoc, math.MaxInt32)
+	require.NoError(t, err)
+	actual, err := iterator.ConsumeValues(limited)
+	require.NoError(t, err)
+	require.Len(t, actual, 2)
+	require.Equal(t, "one", must.NotFail(actual[0].Get("_id")))
+	require.Equal(t, "two", must.NotFail(actual[1].Get("_id")))
+}