diff options
| author | Spencer Jackson <spencer.jackson@mongodb.com> | 2015-02-13 11:49:49 -0500 |
|---|---|---|
| committer | Ramon Fernandez <ramon.fernandez@mongodb.com> | 2015-02-13 17:11:51 -0500 |
| commit | a5408edceb0e6b571bdd634afcf9bc5ee94e29c3 (patch) | |
| tree | 9026bba66caa5d2a5bd57729f9823ee1da8a76ce | |
| parent | 91ab64a4c0b8032120d319bb8c193b6d844a9583 (diff) | |
| download | mongo-a5408edceb0e6b571bdd634afcf9bc5ee94e29c3.tar.gz | |
SERVER-17278: Enforce BSON BinData length
(cherry picked from commit 8ef2743189617343c5c4888aca34a9886d21e783)
| -rw-r--r-- | src/mongo/bson/bson_validate.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/mongo/bson/bson_validate.cpp b/src/mongo/bson/bson_validate.cpp index 0be15d20200..bc27ccae854 100644 --- a/src/mongo/bson/bson_validate.cpp +++ b/src/mongo/bson/bson_validate.cpp @@ -17,6 +17,7 @@ #include <cstring> #include <deque> +#include <limits> #include "mongo/bson/bson_validate.h" #include "mongo/bson/oid.h" @@ -242,6 +243,8 @@ namespace mongo { int sz; if ( !buffer->readNumber<int>( &sz ) ) return makeError("invalid bson", idElem); + if ( sz < 0 || sz == std::numeric_limits<int>::max() ) + return makeError("invalid size in bson", idElem); if ( !buffer->skip( 1 + sz ) ) return makeError("invalid bson", idElem); return Status::OK(); |