Validate uncompressed size in OP_COMPRESSED messages

ExportXMLWordPrintableJSON

    • Type: Task
    • Resolution: Fixed
    • Priority: Unknown
    • 4.18.0
    • Affects Version/s: None
    • Component/s: None
    • None
    • Not Needed
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      dfengliu has created PR #2976: PYTHON-XXXX Validate uncompressed size in OP_COMPRESSED messages in mongo-python-driver

      Issue Text:

        1. Summary

      Validate the `uncompressed_size` field from the OP_COMPRESSED wire protocol compression sub-header against `max_message_size`.

        1. Details

      The `process_compression_header` method in `network_layer.py` previously unpacked the compression sub-header and discarded the `uncompressed_size` field. A malicious or compromised MongoDB server could send a small compressed envelope (passing the envelope size check) that decompresses to a very large payload, causing memory exhaustion.

        1. Changes
      • `process_compression_header` now returns `uncompressed_size` in addition to `op_code` and `compressor_id`
      • The caller validates `uncompressed_size` against `self._max_message_size` and raises `ProtocolError` if it exceeds the limit
      • Added unit test `test_compression_uncompressed_size_exceeds_max_closes`

            Assignee:
            Steve Silvester
            Reporter:
            TPM Jira Automations Bot
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: