SERVER-43751 Recompute compressor manager message parameters

(cherry picked from commit 1411cf602a21e45a5ef42b6869c480eb420976ee)

2 files changed, 25 insertions, 0 deletions

diff --git a/src/mongo/transport/message_compressor_manager.cpp b/src/mongo/transport/message_compressor_manager.cpp
index b7b5bab0e33..6930f881a2c 100644
--- a/src/mongo/transport/message_compressor_manager.cpp
+++ b/src/mongo/transport/message_compressor_manager.cpp
@@ -163,6 +163,10 @@ StatusWith<Message> MessageCompressorManager::decompressMessage(const Message& m
 
     LOG(3) << "Decompressing message with " << compressor->getName();
 
+    if (compressionHeader.uncompressedSize < 0) {
+        return {ErrorCodes::BadValue, "Decompressed message would be negative in size"};
+    }
+
     size_t bufferSize = compressionHeader.uncompressedSize + MsgData::MsgDataHeaderSize;
     if (bufferSize > MaxMessageSizeBytes) {
         return {ErrorCodes::BadValue,
diff --git a/src/mongo/transport/message_compressor_manager_test.cpp b/src/mongo/transport/message_compressor_manager_test.cpp
index 399c9913ea1..7d1011c91ae 100644
--- a/src/mongo/transport/message_compressor_manager_test.cpp
+++ b/src/mongo/transport/message_compressor_manager_test.cpp
@@ -317,6 +317,27 @@ TEST(MessageCompressorManager, MessageSizeTooLarge) {
     ASSERT_NOT_OK(status);
 }
 
+TEST(MessageCompressorManager, MessageSizeTooSmall) {
+    auto registry = buildRegistry();
+    MessageCompressorManager compManager(&registry);
+
+    auto badMessageBuffer = SharedBuffer::allocate(128);
+    MsgData::View badMessage(badMessageBuffer.get());
+    badMessage.setId(1);
+    badMessage.setResponseToMsgId(0);
+    badMessage.setOperation(dbCompressed);
+    badMessage.setLen(128);
+
+    DataRangeCursor cursor(badMessage.data(), badMessage.data() + badMessage.dataLen());
+    uassertStatusOK(cursor.writeAndAdvance<LittleEndian<int32_t>>(dbQuery));
+    uassertStatusOK(cursor.writeAndAdvance<LittleEndian<int32_t>>(-1));
+    uassertStatusOK(
+        cursor.writeAndAdvance<LittleEndian<uint8_t>>(registry.getCompressor("noop")->getId()));
+
+    auto status = compManager.decompressMessage(Message(badMessageBuffer), nullptr).getStatus();
+    ASSERT_NOT_OK(status);
+}
+
 TEST(MessageCompressorManager, RuntMessage) {
     auto registry = buildRegistry();
     MessageCompressorManager compManager(&registry);