diff options
-rw-r--r-- | src/mongo/transport/message_compressor_manager.cpp | 4 | ||||
-rw-r--r-- | src/mongo/transport/message_compressor_manager_test.cpp | 20 |
2 files changed, 24 insertions, 0 deletions
diff --git a/src/mongo/transport/message_compressor_manager.cpp b/src/mongo/transport/message_compressor_manager.cpp index a78667c31b6..0ccd856ad23 100644 --- a/src/mongo/transport/message_compressor_manager.cpp +++ b/src/mongo/transport/message_compressor_manager.cpp @@ -154,6 +154,10 @@ StatusWith<Message> MessageCompressorManager::decompressMessage(const Message& m LOG(3) << "Decompressing message with " << compressor->getName(); + if (compressionHeader.uncompressedSize < 0) { + return {ErrorCodes::BadValue, "Decompressed message would be negative in size"}; + } + size_t bufferSize = compressionHeader.uncompressedSize + MsgData::MsgDataHeaderSize; if (bufferSize > MaxMessageSizeBytes) { return {ErrorCodes::BadValue, diff --git a/src/mongo/transport/message_compressor_manager_test.cpp b/src/mongo/transport/message_compressor_manager_test.cpp index 53a057d5445..ffffebb0c2b 100644 --- a/src/mongo/transport/message_compressor_manager_test.cpp +++ b/src/mongo/transport/message_compressor_manager_test.cpp @@ -343,6 +343,26 @@ TEST(MessageCompressorManager, MessageSizeTooLarge) { ASSERT_NOT_OK(status); } +TEST(MessageCompressorManager, MessageSizeTooSmall) { + auto registry = buildRegistry(); + MessageCompressorManager compManager(®istry); + + auto badMessageBuffer = SharedBuffer::allocate(128); + MsgData::View badMessage(badMessageBuffer.get()); + badMessage.setId(1); + badMessage.setResponseToMsgId(0); + badMessage.setOperation(dbCompressed); + badMessage.setLen(128); + + DataRangeCursor cursor(badMessage.data(), badMessage.data() + badMessage.dataLen()); + cursor.writeAndAdvance<LittleEndian<int32_t>>(dbQuery); + cursor.writeAndAdvance<LittleEndian<int32_t>>(-1); + cursor.writeAndAdvance<LittleEndian<uint8_t>>(registry.getCompressor("noop")->getId()); + + auto status = compManager.decompressMessage(Message(badMessageBuffer), nullptr).getStatus(); + ASSERT_NOT_OK(status); +} + TEST(MessageCompressorManager, RuntMessage) { auto registry = buildRegistry(); MessageCompressorManager compManager(®istry); |