Part 1.1 of NODE-7598

What: A 10-byte BSON document with a string element declaring length 0 passes the on-demand parser's size/terminator guards, advances the cursor to the declared document end, and then makes findNull scan from past the buffer. findNull has no bounds check, and out-of-range Uint8Array reads return undefined (undefined !== 0x00 is always true), so the loop never terminates — synchronous CPU hang.

Root cause: findNull in src/parser/on_demand/parse_to_elements.ts assumes the document is well-formed and omits a < bytes.length guard. The ordinary deserializer rejects stringSize <= 0 (src/parser/deserializer.ts), but that check is not mirrored on the on-demand path.

Conditions required: an application must call the experimental BSON.onDemand.parseToElements API directly on untrusted bytes, without a surrounding timeout / worker isolation. Applications using the standard BSON.deserialize path are not affected.

Pinned ref: 5b42c5a1535d45ec89ab9f1ed3bb249d09730e3c

Details & PoC: int-mongodb-js-bson-ondemand-zero-length-string-hang/README.md and int-mongodb-js-bson-ondemand-zero-length-string-hang/poc/ (run bash poc/run.sh).

Suggested fix: Add a < bytes.length bound to findNull and treat the overrun as the existing "null terminator not found" error.

Use Case

As a... bson user
I want... bson deserialization to guard against malformed bson
So that... invariants are surfaced as errors rather than crashes and hangs

User Experience

• What is the desired/expected outcome for the user once this ticket is implemented?
  • parse_to_elements and its helper functions should detect malformed bson components and exit with an error immediately
• If bug: What is the number of impacted customers? How severe is the impact? Is anyone blocked or broken?

Dependencies

Risks/Unknowns

Acceptance Criteria

Implementation Requirements

Testing Requirements

• unit tests:
  • fill in more corner cases, e.g., string of length zero, which violates the minimum valid bson size of 11 bytes for a string

Documentation Requirements

• DOCSP ticket, API docs, etc

Follow Up Requirements

• additional tickets to file, required releases, etc
• if node behavior differs/will differ from other drivers, confirm with dbx devs what standard to aim for and what plan, if any, exists to reconcile the diverging behavior moving forward