Fix underflow on array deserialization

Closes #243
mongodb · Mar 22, 2021 · 399c4d0 · 399c4d0
1 parent b069ef5
commit 399c4d0
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/de/mod.rs b/src/de/mod.rs
@@ -176,6 +176,13 @@ fn deserialize_array<R: Read + ?Sized>(reader: &mut R, utf8_lossy: bool) -> Resu
     let mut arr = Array::new();
     let length = read_i32(reader)?;
 
+    if !(MIN_BSON_DOCUMENT_SIZE..=MAX_BSON_SIZE).contains(&length) {
+        return Err(Error::invalid_length(
+            length as usize,
+            &format!("array length must be between {} and {}", MIN_BSON_DOCUMENT_SIZE, MAX_BSON_SIZE).as_str(),
+        ));
+    }
+
     ensure_read_exactly(
         reader,
         (length as usize) - 4,