Detailed steps to reproduce the problem?

DecompressPayload uses CompressionOpts.UncompressedSize, rea as an int32 off the wire from the OP_COMPRESSED header to size the output buffer, without validating it.

If that value is negative, the driver panics rather than returning an error:

zlib: make([]byte, opts.UncompressedSize) panics: makeslice: len out of range
zstd: make([]byte, 0, opts.UncompressedSize) panics: makeslice: cap out of range
snappy: already safe: the existing int32(l) != opts.UncompressedSize check rejects it, since a negative value never equals a non-negative snappy.DecodedLen.

Definition of done: what must be done to consider the task complete?

• Negative UncompressedSize returns an error instead of panicking, for every compressor.
• Regression tests feed valid compressed bytes with UncompressedSize: -1

The exact Go version used, with patch level:

$ go version

The exact version of the Go driver used:

$ go list -m go.mongodb.org/mongo-driver

Describe how MongoDB is set up. Local vs Hosted, version, topology, load balanced, etc.

The operating system and version (e.g. Windows 7, OSX 10.8, ...)

Security Vulnerabilities

If you’ve identified a security vulnerability in a driver or any other MongoDB project, please report it according to the instructions here