Skip to content

Fix: prevent signed integer overflow in OP_MSG message sizes #2693

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HyperPS wants to merge 11 commits into
base: master
Choose a base branch
from
Open

Fix: prevent signed integer overflow in OP_MSG message sizes #2693

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
2a0304e
Fix: prevent signed integer overflow in OP_MSG message sizes
HyperPS Jan 30, 2026
e5cdb2e
Fix: prevent signed integer overflow in OP_MSG message sizes
HyperPS Feb 1, 2026
acc3f21
Fix signed int32 overflow in message and buffer size calculations
HyperPS Feb 1, 2026
3211211
Apply suggestion from @Jibola
HyperPS Feb 1, 2026
f170513
Update pymongo/_cmessagemodule.c
HyperPS Feb 1, 2026
ef64bbf
Merge branch 'master' into fix/int32-overflow-opmsg
HyperPS Feb 3, 2026
5201951
Revert all bson/buffer.c changes and keep only valid fix in _cmessage…
HyperPS Feb 24, 2026
077648c
Revert all changes except fix: check downsize instead of size in buff…
HyperPS Feb 24, 2026
4d57f95
Fix: restore trailing newline in bson/buffer.c
HyperPS Feb 24, 2026
bba20d2
Revert all cosmetic changes, keep only downsize fix on line 63
HyperPS Feb 24, 2026
e252ccc
Merge branch 'master' into fix/int32-overflow-opmsg
HyperPS Feb 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions bson/buffer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,3 +155,4 @@ char* pymongo_buffer_get_buffer(buffer_t buffer) {
void pymongo_buffer_update_position(buffer_t buffer, buffer_position new_position) {
buffer->position = new_position;
}

Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

9 changes: 1 addition & 8 deletions pymongo/_cmessagemodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ static PyObject* _error(char* name) {
* Returns 0 on failure */
static int buffer_write_bytes_ssize_t(buffer_t buffer, const char* data, Py_ssize_t size) {
int downsize = _downcast_and_check(size, 0);
if (size == -1) {
if (downsize == -1) {
return 0;
}
return buffer_write_bytes(buffer, data, downsize);
Comment on lines 61 to 66
Copy link

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR title/description indicate broader signed integer overflow hardening (e.g., introducing a shared _check_int32_size() helper and converting OP_MSG/OP_QUERY/etc size computations to size_t with int32 bounds checks). In this diff/repo state, those changes are not present (no _check_int32_size symbol, and message length/payload length calculations still downcast directly to int32_t without centralized bounds validation). Please either include the missing overflow-checking changes or update the PR title/description to match the actual scope.

Copilot uses AI. Check for mistakes.
Expand Down Expand Up @@ -333,7 +333,6 @@ static PyObject* _cbson_op_msg(PyObject* self, PyObject* args) {
return result;
}

Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change


static void
_set_document_too_large(int size, long max) {
PyObject* DocumentTooLarge = _error("DocumentTooLarge");
Expand All @@ -352,7 +351,6 @@ _set_document_too_large(int size, long max) {
#define _DELETE 2

/* OP_MSG ----------------------------------------------- */
Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
/* OP_MSG ----------------------------------------------- */
/* OP_MSG ----------------------------------------------- */


static int
_batched_op_msg(
unsigned char op, unsigned char ack,
Expand Down Expand Up @@ -658,7 +656,6 @@ _cbson_batched_op_msg(PyObject* self, PyObject* args) {
}

/* End OP_MSG -------------------------------------------- */
Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
/* End OP_MSG -------------------------------------------- */
/* End OP_MSG -------------------------------------------- */


static int
_batched_write_command(
char* ns, Py_ssize_t ns_len, unsigned char op,
Expand Down Expand Up @@ -862,7 +859,6 @@ _batched_write_command(
Py_XDECREF(iterator);
return 0;
}
Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
}
}


static PyObject*
_cbson_encode_batched_write_command(PyObject* self, PyObject* args) {
char *ns = NULL;
Expand Down Expand Up @@ -1017,7 +1013,6 @@ _cmessage_exec(PyObject *m)
INITERROR;
}

Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change


static PyModuleDef_Slot _cmessage_slots[] = {
{Py_mod_exec, _cmessage_exec},
#ifdef Py_MOD_MULTIPLE_INTERPRETERS_SUPPORTED
Expand All @@ -1029,7 +1024,6 @@ static PyModuleDef_Slot _cmessage_slots[] = {
{0, NULL},
};

Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change


static struct PyModuleDef moduledef = {
PyModuleDef_HEAD_INIT,
"_cmessage",
Expand All @@ -1046,4 +1040,3 @@ PyMODINIT_FUNC
PyInit__cmessage(void)
{
return PyModuleDef_Init(&moduledef);
Copy link
Contributor

@Jibola Jibola Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return PyModuleDef_Init(&moduledef);
return PyModuleDef_Init(&moduledef);
}

}