[SERVER-51719] BSONElement::toString must account for negative binData len Created: 17/Oct/20  Updated: 29/Oct/23  Resolved: 19/Oct/20

Status: Closed
Project: Core Server
Component/s: Internal Code
Affects Version/s: None
Fix Version/s: 4.9.0

Type: Bug Priority: Major - P3
Reporter: Billy Donahue Assignee: Billy Donahue
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
Duplicate
duplicates SERVER-51304 Fix BSONElement toString method for B... Closed
Problem/Incident
is caused by SERVER-43909 util/hex.h is non-portable, inefficie... Closed
Backwards Compatibility: Fully Compatible
Operating System: ALL
Sprint: Service arch 2020-11-02
Participants:
Linked BF Score: 50

 Description   

SERVER-43909 changed toHex(char*,int) to hexblob::encode(char*,size_t).
This is the right signature for an encoding function, but a subtlety was ignored in the changeover. The len is, in at least one place, potentially negative. This can happen in BSONElement::toString, on a malformed binData type 2 payload.

Comment here discusses same details.
https://jira.mongodb.org/browse/SERVER-43909?focusedCommentId=3450546&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-3450546



 Comments   
Comment by Githook User [ 19/Oct/20 ]

Author:

{'name': 'Billy Donahue', 'email': 'billy.donahue@mongodb.com', 'username': 'BillyDonahue'}

Message: SERVER-51719 BSONElement::toString must handle len < 0
Branch: master
https://github.com/mongodb/mongo/commit/082f1a153bf5245081279e0d1d57048066c493e7

Comment by Billy Donahue [ 17/Oct/20 ]

CR https://mongodbcr.appspot.com/687240002/

Generated at Thu Feb 08 05:26:14 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.