diff options
| -rw-r--r-- | src/mongo/bson/bson_validate.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/mongo/bson/bson_validate.cpp b/src/mongo/bson/bson_validate.cpp index 5e0a0341909..778a8d83018 100644 --- a/src/mongo/bson/bson_validate.cpp +++ b/src/mongo/bson/bson_validate.cpp @@ -29,6 +29,7 @@ #include <cstring> #include <deque> +#include <limits> #include "mongo/base/data_view.h" #include "mongo/bson/bson_validate.h" @@ -254,6 +255,8 @@ namespace mongo { int sz; if ( !buffer->readNumber<int>( &sz ) ) return makeError("invalid bson", idElem); + if ( sz < 0 || sz == std::numeric_limits<int>::max() ) + return makeError("invalid size in bson", idElem); if ( !buffer->skip( 1 + sz ) ) return makeError("invalid bson", idElem); return Status::OK(); |