SERVER-30720 Integer overflow in SharedBuffer::grow_reallocate

Move the length check before the while loop.

1 files changed, 6 insertions, 5 deletions

diff --git a/src/mongo/bson/util/builder.h b/src/mongo/bson/util/builder.h
index 9d4ad89d1a0..b7a4525a17b 100644
--- a/src/mongo/bson/util/builder.h
+++ b/src/mongo/bson/util/builder.h
@@ -340,15 +340,16 @@ private:
     }
     /* "slow" portion of 'grow()'  */
     void NOINLINE_DECL grow_reallocate(int minSize) {
+        if (minSize > BufferMaxSize) {
+            std::stringstream ss;
+            ss << "BufBuilder attempted to grow() to " << minSize << " bytes, past the 64MB limit.";
+            msgasserted(13548, ss.str().c_str());
+        }
+
         int a = 64;
         while (a < minSize)
             a = a * 2;
 
-        if (a > BufferMaxSize) {
-            std::stringstream ss;
-            ss << "BufBuilder attempted to grow() to " << a << " bytes, past the 64MB limit.";
-            msgasserted(13548, ss.str().c_str());
-        }
         _buf.realloc(a);
         size = a;
     }