SERVER-44064 Perform explicit cast on MessageCompressorManager parameter

(cherry picked from commit ffc6e38bc90750cc639317fc713e7bc4e0bf596e)

2 files changed, 26 insertions, 1 deletions

diff --git a/src/mongo/transport/message_compressor_manager.cpp b/src/mongo/transport/message_compressor_manager.cpp
index 6930f881a2c..c96a7f791f6 100644
--- a/src/mongo/transport/message_compressor_manager.cpp
+++ b/src/mongo/transport/message_compressor_manager.cpp
@@ -167,7 +167,10 @@ StatusWith<Message> MessageCompressorManager::decompressMessage(const Message& m
         return {ErrorCodes::BadValue, "Decompressed message would be negative in size"};
     }
 
-    size_t bufferSize = compressionHeader.uncompressedSize + MsgData::MsgDataHeaderSize;
+    // Explicitly promote `uncompressedSize` to a 64-bit integer before addition in order to
+    // avoid potential overflow.
+    size_t bufferSize =
+        static_cast<size_t>(compressionHeader.uncompressedSize) + MsgData::MsgDataHeaderSize;
     if (bufferSize > MaxMessageSizeBytes) {
         return {ErrorCodes::BadValue,
                 "Decompressed message would be larger than maximum message size"};
diff --git a/src/mongo/transport/message_compressor_manager_test.cpp b/src/mongo/transport/message_compressor_manager_test.cpp
index 7d1011c91ae..4d46f1e5188 100644
--- a/src/mongo/transport/message_compressor_manager_test.cpp
+++ b/src/mongo/transport/message_compressor_manager_test.cpp
@@ -317,6 +317,28 @@ TEST(MessageCompressorManager, MessageSizeTooLarge) {
     ASSERT_NOT_OK(status);
 }
 
+TEST(MessageCompressorManager, MessageSizeMax32Bit) {
+    auto registry = buildRegistry();
+    MessageCompressorManager compManager(&registry);
+
+    auto badMessageBuffer = SharedBuffer::allocate(128);
+    MsgData::View badMessage(badMessageBuffer.get());
+    badMessage.setId(1);
+    badMessage.setResponseToMsgId(0);
+    badMessage.setOperation(dbCompressed);
+    badMessage.setLen(128);
+
+    DataRangeCursor cursor(badMessage.data(), badMessage.data() + badMessage.dataLen());
+    uassertStatusOK(cursor.writeAndAdvance<LittleEndian<int32_t>>(dbQuery));
+    uassertStatusOK(
+        cursor.writeAndAdvance<LittleEndian<int32_t>>(std::numeric_limits<int32_t>::max()));
+    uassertStatusOK(
+        cursor.writeAndAdvance<LittleEndian<uint8_t>>(registry.getCompressor("noop")->getId()));
+
+    auto status = compManager.decompressMessage(Message(badMessageBuffer), nullptr).getStatus();
+    ASSERT_NOT_OK(status);
+}
+
 TEST(MessageCompressorManager, MessageSizeTooSmall) {
     auto registry = buildRegistry();
     MessageCompressorManager compManager(&registry);