Validate uncompressed size in OP_COMPRESSED messages

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Unresolved
    • Priority: Unknown
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • Not Needed
    • None
    • None
    • None
    • None
    • None
    • None

      dfengliu has created PR #2976: PYTHON-XXXX Validate uncompressed size in OP_COMPRESSED messages in mongo-python-driver

      Issue Text:

        1. Summary

      Validate the `uncompressed_size` field from the OP_COMPRESSED wire protocol compression sub-header against `max_message_size`.

        1. Details

      The `process_compression_header` method in `network_layer.py` previously unpacked the compression sub-header and discarded the `uncompressed_size` field. A malicious or compromised MongoDB server could send a small compressed envelope (passing the envelope size check) that decompresses to a very large payload, causing memory exhaustion.

        1. Changes
      • `process_compression_header` now returns `uncompressed_size` in addition to `op_code` and `compressor_id`
      • The caller validates `uncompressed_size` against `self._max_message_size` and raises `ProtocolError` if it exceeds the limit
      • Added unit test `test_compression_uncompressed_size_exceeds_max_closes`

            Assignee:
            Steve Silvester
            Reporter:
            TPM Jira Automations Bot
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: