::mongo::BSONObj class has insufficient validation for bad data. This means that on some bad input it may crash. See the attached test case which shows an example bad data which demonstrates the problem - this is based on real data we've got from core dump in our application. See also the proposed fix for the code in the attached diff.