@@ -129,7 +129,7 @@ static PyObject* _error(char* name) {
129
129
/* Safely downcast from Py_ssize_t to int, setting an
130
130
* exception and returning -1 on error. */
131
131
static int
132
- _downcast_and_check (Py_ssize_t size , unsigned extra ) {
132
+ _downcast_and_check (Py_ssize_t size , int extra ) {
133
133
if (size > BSON_MAX_SIZE || ((BSON_MAX_SIZE - extra ) < size )) {
134
134
PyObject * InvalidStringData = _error ("InvalidStringData" );
135
135
if (InvalidStringData ) {
@@ -1382,9 +1382,9 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1382
1382
case 3 :
1383
1383
{
1384
1384
PyObject * collection ;
1385
- unsigned size ;
1385
+ int size ;
1386
1386
memcpy (& size , buffer + * position , 4 );
1387
- if (max < size ) {
1387
+ if (size < 0 || max < size ) {
1388
1388
goto invalid ;
1389
1389
}
1390
1390
value = elements_to_dict (self , buffer + * position + 4 ,
@@ -1667,7 +1667,7 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1667
1667
int flags ;
1668
1668
size_t flags_length , i ;
1669
1669
size_t pattern_length = strlen (buffer + * position );
1670
- if (max < pattern_length || pattern_length > BSON_MAX_SIZE ) {
1670
+ if (pattern_length > BSON_MAX_SIZE || max < ( int ) pattern_length ) {
1671
1671
goto invalid ;
1672
1672
}
1673
1673
pattern = PyUnicode_DecodeUTF8 (buffer + * position , pattern_length , "strict" );
@@ -1679,7 +1679,7 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1679
1679
Py_DECREF (pattern );
1680
1680
goto invalid ;
1681
1681
}
1682
- if (max < pattern_length + flags_length ) {
1682
+ if (max < ( int )( pattern_length + flags_length ) ) {
1683
1683
Py_DECREF (pattern );
1684
1684
goto invalid ;
1685
1685
}
@@ -1706,24 +1706,22 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1706
1706
}
1707
1707
case 12 :
1708
1708
{
1709
- size_t collection_length ;
1709
+ size_t coll_length ;
1710
1710
PyObject * collection ;
1711
1711
PyObject * id ;
1712
1712
1713
1713
* position += 4 ;
1714
- collection_length = strlen (buffer + * position );
1715
- if (max < collection_length || collection_length > BSON_MAX_SIZE ) {
1714
+ coll_length = strlen (buffer + * position );
1715
+ if (coll_length > BSON_MAX_SIZE || max < ( int ) coll_length + 12 ) {
1716
1716
goto invalid ;
1717
1717
}
1718
- collection = PyUnicode_DecodeUTF8 (buffer + * position , collection_length , "strict" );
1718
+ collection = PyUnicode_DecodeUTF8 (buffer + * position ,
1719
+ coll_length , "strict" );
1719
1720
if (!collection ) {
1720
1721
return NULL ;
1721
1722
}
1722
- * position += (int )collection_length + 1 ;
1723
- if (max < collection_length + 12 ) {
1724
- Py_DECREF (collection );
1725
- goto invalid ;
1726
- }
1723
+ * position += (int )coll_length + 1 ;
1724
+
1727
1725
id = PyObject_CallFunction (state -> ObjectId , "s#" , buffer + * position , 12 );
1728
1726
if (!id ) {
1729
1727
Py_DECREF (collection );
@@ -1761,7 +1759,7 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1761
1759
1762
1760
* position += 8 ;
1763
1761
code_length = strlen (buffer + * position );
1764
- if (max < 8 + code_length || code_length > BSON_MAX_SIZE ) {
1762
+ if (code_length > BSON_MAX_SIZE || max < 8 + ( int ) code_length ) {
1765
1763
goto invalid ;
1766
1764
}
1767
1765
code = PyUnicode_DecodeUTF8 (buffer + * position , code_length , "strict" );
@@ -1877,7 +1875,7 @@ static PyObject* elements_to_dict(PyObject* self, const char* string, int max,
1877
1875
PyObject * value ;
1878
1876
int type = (int )string [position ++ ];
1879
1877
size_t name_length = strlen (string + position );
1880
- if (name_length > BSON_MAX_SIZE || position + name_length >= max ) {
1878
+ if (name_length > BSON_MAX_SIZE || position + ( int ) name_length >= max ) {
1881
1879
PyObject * InvalidBSON = _error ("InvalidBSON" );
1882
1880
if (InvalidBSON ) {
1883
1881
PyErr_SetNone (InvalidBSON );
@@ -1908,7 +1906,7 @@ static PyObject* elements_to_dict(PyObject* self, const char* string, int max,
1908
1906
}
1909
1907
1910
1908
static PyObject * _cbson_bson_to_dict (PyObject * self , PyObject * args ) {
1911
- unsigned int size ;
1909
+ int size ;
1912
1910
Py_ssize_t total_size ;
1913
1911
const char * string ;
1914
1912
PyObject * bson ;
@@ -1955,7 +1953,16 @@ static PyObject* _cbson_bson_to_dict(PyObject* self, PyObject* args) {
1955
1953
if (!string ) {
1956
1954
return NULL ;
1957
1955
}
1956
+
1958
1957
memcpy (& size , string , 4 );
1958
+ if (size < 0 ) {
1959
+ PyObject * InvalidBSON = _error ("InvalidBSON" );
1960
+ if (InvalidBSON ) {
1961
+ PyErr_SetString (InvalidBSON , "invalid message size" );
1962
+ Py_DECREF (InvalidBSON );
1963
+ }
1964
+ return NULL ;
1965
+ }
1959
1966
1960
1967
if (total_size < size ) {
1961
1968
PyObject * InvalidBSON = _error ("InvalidBSON" );
@@ -1995,7 +2002,7 @@ static PyObject* _cbson_bson_to_dict(PyObject* self, PyObject* args) {
1995
2002
}
1996
2003
1997
2004
static PyObject * _cbson_decode_all (PyObject * self , PyObject * args ) {
1998
- unsigned int size ;
2005
+ int size ;
1999
2006
Py_ssize_t total_size ;
2000
2007
const char * string ;
2001
2008
PyObject * bson ;
@@ -2045,6 +2052,15 @@ static PyObject* _cbson_decode_all(PyObject* self, PyObject* args) {
2045
2052
}
2046
2053
2047
2054
memcpy (& size , string , 4 );
2055
+ if (size < 0 ) {
2056
+ PyObject * InvalidBSON = _error ("InvalidBSON" );
2057
+ if (InvalidBSON ) {
2058
+ PyErr_SetString (InvalidBSON , "invalid message size" );
2059
+ Py_DECREF (InvalidBSON );
2060
+ }
2061
+ Py_DECREF (result );
2062
+ return NULL ;
2063
+ }
2048
2064
2049
2065
if (total_size < size ) {
2050
2066
PyObject * InvalidBSON = _error ("InvalidBSON" );
0 commit comments