diff options
| author | Spencer Jackson <spencer.jackson@mongodb.com> | 2015-02-13 11:49:49 -0500 |
|---|---|---|
| committer | Ramon Fernandez <ramon@mongodb.com> | 2015-02-15 10:27:20 -0500 |
| commit | ac7d4eac9eb895886086eb6f0b763147ec7f3b90 (patch) | |
| tree | d3e6a2a29e05bc9b9b110ac36d9f3ab32d3573d8 | |
| parent | fef75e46001b3c8cc6dd399476370fc99305b94e (diff) | |
| download | mongo-ac7d4eac9eb895886086eb6f0b763147ec7f3b90.tar.gz | |
SERVER-17278: Enforce BSON BinData length
(cherry picked from commit 8ef2743189617343c5c4888aca34a9886d21e783)
| -rw-r--r-- | src/mongo/bson/bson_validate.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/mongo/bson/bson_validate.cpp b/src/mongo/bson/bson_validate.cpp index 5e0a0341909..778a8d83018 100644 --- a/src/mongo/bson/bson_validate.cpp +++ b/src/mongo/bson/bson_validate.cpp @@ -29,6 +29,7 @@ #include <cstring> #include <deque> +#include <limits> #include "mongo/base/data_view.h" #include "mongo/bson/bson_validate.h" @@ -254,6 +255,8 @@ namespace mongo { int sz; if ( !buffer->readNumber<int>( &sz ) ) return makeError("invalid bson", idElem); + if ( sz < 0 || sz == std::numeric_limits<int>::max() ) + return makeError("invalid size in bson", idElem); if ( !buffer->skip( 1 + sz ) ) return makeError("invalid bson", idElem); return Status::OK(); |