|
SERVER-43909 changed toHex(char*,int) to hexblob::encode(char*,size_t).
This is the right signature for an encoding function, but a subtlety was ignored in the changeover. The len is, in at least one place, potentially negative. This can happen in BSONElement::toString, on a malformed binData type 2 payload.
Comment here discusses same details.
https://jira.mongodb.org/browse/SERVER-43909?focusedCommentId=3450546&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-3450546
|