The BSONElement constructor that allows you to optionally provide fieldName and value sizes optionally using -1 are unsafe. They do not provide a buffer size parameter to make sure we do not read out-of-bounds for the provided input buffer.

The API can be improved to provide other functions to calculate these sizes so we can also get rid of a bunch of unnecessary branching.