Details
-
Bug
-
Resolution: Fixed
-
Major - P3
-
None
-
None
-
None
-
Fully Compatible
-
ALL
-
130
Description
The following line converts a double (from user input) to int without any kind of bounds check. If the double cannot be represented by an int, this is undefined behavior.
Example:
db.c.find(BinData(18446744073709552000, 'AAA=')) |
The BinData subtype is only one byte, so we should just ensure the value is between 0 and 255 before doing the cast.