Detailed steps to reproduce the problem?

There isn't really a way to repro this in the driver, a user would have to directly be using the bsoncore library directly attempting to validate against invalid BSON:

doc := Document{
    0x0d, 0x00, 0x00, 0x00, // document length = 13
    0x05,       // type = binary
    0x61, 0x00, // key "a"
    0xff, 0xff, 0xff, 0x7f, // payload length = math.MaxInt32
    0x00, // subtype
    0x00, // document terminator
}

This will result in the string path of the valueLength helper function, with a length of 2^(32-1) since this path also does length += 4, we get an overflow.

This could also happen if the server sends malformed documents, though as a rule we shouldn't anticipate buggy server behavior.

Definition of done: what must be done to consider the task complete?

If the length is negative post-processing, then valueLength should return false.

Security Vulnerabilities

NA