Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-51719

BSONElement::toString must account for negative binData len

XMLWordPrintableJSON

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 4.9.0
    • Affects Version/s: None
    • Component/s: Internal Code
    • Labels:
      None
    • Fully Compatible
    • ALL
    • Service arch 2020-11-02
    • 50

      SERVER-43909 changed toHex(char*,int) to hexblob::encode(char*,size_t).
      This is the right signature for an encoding function, but a subtlety was ignored in the changeover. The len is, in at least one place, potentially negative. This can happen in BSONElement::toString, on a malformed binData type 2 payload.

      Comment here discusses same details.
      https://jira.mongodb.org/browse/SERVER-43909?focusedCommentId=3450546&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-3450546

            Assignee:
            billy.donahue@mongodb.com Billy Donahue
            Reporter:
            billy.donahue@mongodb.com Billy Donahue
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: