Out-of-bounds write to a buffer

Defect 102107 (STATIC_C)
Checker OVERRUN (subcategory write)
File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

       iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

             iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);

File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

       iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

             iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);

File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

       iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

             iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);

File: /src/mongoc/mongoc-write-command-legacy.c
Function _mongoc_write_command_insert_legacy
/src/mongoc/mongoc-write-command-legacy.c, line: 701
Assigning: "iov" = "bson_malloc(16UL * command->n_documents)".

       iov = (mongoc_iovec_t *) bson_malloc ((sizeof *iov) * command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 712
Tracking "n_docs_in_batch" since "idx" is tracked with "iov".

          BSON_ASSERT (n_docs_in_batch <= idx);

/src/mongoc/mongoc-write-command-legacy.c, line: 713
Tracking "idx" since "command->n_documents" is tracked with "iov".

          BSON_ASSERT (idx <= command->n_documents);

/src/mongoc/mongoc-write-command-legacy.c, line: 744
Overrunning dynamic array "iov" at offset corresponding to index variable "n_docs_in_batch".

             iov[n_docs_in_batch].iov_base = (void *) bson_get_data (bson);