-
Type: Bug
-
Resolution: Fixed
-
Priority: Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
-
Query Integration
-
Fully Compatible
-
ALL
-
v7.0
-
0
In https://jira.mongodb.org/browse/BF-33414 , we detected a case where the fuzzer tries to generate an invalid BSON object, providing null terminators in the field of a BSON object. Although null terminators are allowed in the value of a bson element, they are not permitted in the fieldname of the BSON element. In the failing case, we created an invalid BSON object as such:
var invalidBson = _buildBsonObj('_id', 2, '\0\0', 3);
The fix for this, is to prevent creating such a bson object. The implementation is here https://github.com/10gen/mongo/blob/master/src/mongo/shell/shell_utils.cpp#L735 .
We could assert that the fieldname does not contain null terminators:
uassert(7587900, str::stream() << "BSON field name must not contain null terminators : " << name, std::string::npos == name.str().find('\0'));