Detailed steps to reproduce the problem?

Found by the PYTHON-4232 BSON fuzzer; the Evergreen fuzz task failed with:

AssertionError: C extension and pure-Python bson.decode_all() disagree: C=failure, pure=success for input: b'\x0c\x00\x00\x00\x05\x00\x00\x00\x00\x00\x04\x00'

https://spruce.corp.mongodb.com/task/mongo_python_driver_fuzz_rhel8_fuzz_patch_e0b11bf246f9668ae2ed9be7703ebb8b4d862b7e_6acf7861d0463e000733a876_26_10_14_12_41_14/logs?execution=0

Reproducing locally:

$ python -c "from bson import decode_all; print(decode_all(b'\x0c\x00\x00\x00\x05\x00\x00\x00\x00\x00\x04\x00'))"

With the C extension present this raises InvalidBSON: invalid length or type code. With bson._cbson blocked it returns {{[

]}}.

The input is a binary element with subtype 4 (UUID) and a 0-byte payload. The same disagreement affects decode(), decode_all(), and is_valid(). The driver can also encode such a document and then fail to decode it: {{encode(

)}} succeeds, and decoding the result raises under the C extension.

Definition of done: what must be done to consider the task complete?

Both implementations agree on these documents: binary subtypes 3 and 4 with payloads other than 16 bytes decode to Binary when no UUID conversion is requested (the default UNSPECIFIED representation), and raise when conversion to uuid.UUID is requested. The reproducer is committed in fuzz/regression/ with a unit test.

The exact Python version used, with patch level:

CPython 3.13.15 on Evergreen (distro rhel8.10-small); also reproduces on CPython 3.14.7.

The exact version of PyMongo used, with patch level:

4.19.0.dev0 built from commit e0b11bf2, with pymongo.has_c() == True. The eager 16-byte check is also present in released PyMongo 4.14, so this discrepancy is long standing, not a recent regression.

Describe how MongoDB is set up. Local vs Hosted, version, topology, load balanced, etc.

Not applicable; the failure is in BSON decoding only and no server is involved.

The operating system and version (e.g. Windows 7, OSX 10.8, ...)

Red Hat Enterprise Linux 8.10 (Evergreen); also Ubuntu 22.04 (local reproduction).

Web framework or asynchronous network library used, if any, with version (e.g. Django 1.7, mod_wsgi 4.3.0, gevent 1.0.1, Tornado 4.0.2, ...)

None.

Security Vulnerabilities

No security vulnerability identified; the input is rejected by one implementation and accepted by the other, without crashing or corrupting memory.