Validating the string in a DBPOINTER type element does not catch all invalid lengths of the string, resulting in possibly dereferencing past the BSON bounds.