MONGOCRYPT-807 Add missing error state transition (#1010)

* add missing `_mongocrypt_ctx_fail` in `FLE2RangeFindDriverSpec_to_ciphertexts`

Author: kevinAlbs

src/mongocrypt-ctx-encrypt.c

@@ -1259,6 +1259,7 @@ static bool FLE2RangeFindDriverSpec_to_ciphertexts(mongocrypt_ctx_t *ctx, mongoc
                                                   &iter,
                                                   &with_ciphertexts,
                                                   ctx->status)) {
+            _mongocrypt_ctx_fail(ctx);
             goto fail;
         }
     }

test/test-mongocrypt-ctx-encrypt.c

@@ -1988,6 +1988,7 @@ static void ee_testcase_run(ee_testcase *tc) {
         bool ret = mongocrypt_ctx_finalize(ctx, got);
         if (tc->expect_finalize_error) {
             ASSERT_FAILS(ret, ctx, tc->expect_finalize_error);
+            ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_ERROR);
         } else {
             ASSERT_OK(ret, ctx);
             ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(tc->expect, got);
@@ -2447,6 +2448,24 @@ static void _test_encrypt_fle2_explicit(_mongocrypt_tester_t *tester) {
         ee_testcase_run(&tc);
     }
 
+    {
+        ee_testcase tc = {0};
+        tc.desc = "crossed bounds fails";
+        tc.algorithm = MONGOCRYPT_ALGORITHM_RANGE_STR;
+        tc.query_type = MONGOCRYPT_QUERY_TYPE_RANGE_STR;
+        tc.user_key_id = &keyABC_id;
+        tc.contention_factor = OPT_I64(0);
+        tc.range_opts = TEST_BSON(RAW_STRING({"min" : {"$numberInt" : "0"}, "max" : {"$numberInt" : "100"}}));
+        tc.msg = TEST_BSON(RAW_STRING({
+            "v" :
+                {"$and" : [ {"age" : {"$gt" : {"$numberInt" : "25"}}}, {"age" : {"$lt" : {"$numberInt" : "15"}}} ]}
+        }));
+        tc.keys_to_feed[0] = keyABC;
+        tc.expect_finalize_error = "must be less than or equal to range max";
+        tc.is_expression = true;
+        ee_testcase_run(&tc);
+    }
+
     _mongocrypt_buffer_cleanup(&keyABC_id);
     _mongocrypt_buffer_cleanup(&key123_id);
 }