Detailed steps to reproduce the problem?

Three exported entry points that exist to accept untrusted BSON read a length
prefix out of the input and use it to index or reslice without enforcing the
5-byte BSON document minimum. Each panics on a <5 bytes:

• Array.Validate (x/bsonx/bsoncore/array.go) indexes a[length-1]. Unlike its sibling Document.Validate it carries no length < 5 guard, so a declared length of 0 yields a[-1].
• newBufferFromReader (x/bsonx/bsoncore/document.go) rejects only length < 0 before doing buffer[4:] and buffer[length-1]. It backs bson.ReadDocument, bson.ReadArray, bsoncore.NewDocumentFromReader and bsoncore.NewArrayFromReader, so a stream whose header declares 0-4 panics.
• copyBytesToValueWriter (bson/copier.go) reslices rem[:length-4] after checking only that the buffer is long enough, so marshaling a struct field holding a short bson.Raw or bsoncore.Document panics.

Definition of done: what must be done to consider the task complete?

• Each of the three sites rejects a declared length below the 5-byte BSON minimum.
• Array.Validate returns ErrInvalidLength, consistent with Document.Validate on the same input.
• newBufferFromReader returns ErrInvalidLength for any length < 5, not just negative ones.
• copyBytesToValueWriter returns an error rather than panicking; that error should be matchable with errors.Is against bsoncore.ErrInvalidLength so all three paths report the condition uniformly.
• Regression tests cover Array.Validate, both *FromReader constructors and the copier.

The exact Go version used, with patch level:

$ go version

The exact version of the Go driver used:

$ go list -m go.mongodb.org/mongo-driver

Describe how MongoDB is set up. Local vs Hosted, version, topology, load balanced, etc.

The operating system and version (e.g. Windows 7, OSX 10.8, ...)

Security Vulnerabilities

If you’ve identified a security vulnerability in a driver or any other MongoDB project, please report it according to the instructions here