@@ -83,28 +83,28 @@ static struct module_state _state;
8383 */
8484#if defined(_MSC_VER ) && (_MSC_VER >= 1400 )
8585#define INT2STRING (buffer , i ) \
86- *(buffer) = malloc(_scprintf("%ld ", (i)) + 1), \
86+ *(buffer) = malloc(_scprintf("%d ", (i)) + 1), \
8787 (!(buffer) ? \
8888 -1 : \
8989 _snprintf_s(*(buffer), \
90- _scprintf("%ld ", (i)) + 1, \
91- _scprintf("%ld ", (i)) + 1, \
92- "%ld", \
90+ _scprintf("%d ", (i)) + 1, \
91+ _scprintf("%d ", (i)) + 1, \
92+ "%d", \
9393 (i)))
9494#define STRCAT (dest , n , src ) strcat_s((dest), (n), (src))
9595#else
9696#define INT2STRING (buffer , i ) \
97- *(buffer) = malloc(_scprintf("%ld ", (i)) + 1), \
97+ *(buffer) = malloc(_scprintf("%d ", (i)) + 1), \
9898 (!(buffer) ? \
9999 -1 : \
100100 _snprintf(*(buffer), \
101- _scprintf("%ld ", (i)) + 1, \
102- "%ld", \
101+ _scprintf("%d ", (i)) + 1, \
102+ "%d", \
103103 (i)))
104104#define STRCAT (dest , n , src ) strcat((dest), (src))
105105#endif
106106#else
107- #define INT2STRING (buffer , i ) asprintf((buffer), "%ld ", (i))
107+ #define INT2STRING (buffer , i ) asprintf((buffer), "%d ", (i))
108108#define STRCAT (dest , n , src ) strcat((dest), (src))
109109#endif
110110
@@ -453,7 +453,15 @@ static int _write_element_to_buffer(PyObject* self, buffer_t buffer, int type_by
453453 return 0 ;
454454 }
455455
456- items = PySequence_Size (value );
456+ if ((items = PySequence_Size (value )) > BSON_MAX_SIZE ) {
457+ PyObject * BSONError = _error ("BSONError" );
458+ if (BSONError ) {
459+ PyErr_SetString (BSONError ,
460+ "Too many items to serialize." );
461+ Py_DECREF (BSONError );
462+ }
463+ return 0 ;
464+ }
457465 for (i = 0 ; i < items ; i ++ ) {
458466 int list_type_byte = buffer_save_space (buffer , 1 );
459467 char * name = NULL ;
@@ -463,7 +471,7 @@ static int _write_element_to_buffer(PyObject* self, buffer_t buffer, int type_by
463471 PyErr_NoMemory ();
464472 return 0 ;
465473 }
466- if (INT2STRING (& name , i ) < 0 || !name ) {
474+ if (INT2STRING (& name , ( int ) i ) < 0 || !name ) {
467475 PyErr_NoMemory ();
468476 return 0 ;
469477 }
@@ -1449,12 +1457,12 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
14491457
14501458 int bson_type = (int )buffer [(* position )++ ];
14511459 size_t key_size = strlen (buffer + * position );
1452- if (( size_t )( int ) key_size != key_size ) {
1460+ if (key_size > BSON_MAX_SIZE ) {
14531461 Py_DECREF (value );
14541462 goto invalid ;
14551463 }
14561464 /* just skip the key, they're in order. */
1457- * position += key_size + 1 ;
1465+ * position += ( int ) key_size + 1 ;
14581466 to_append = get_value (self , buffer , position , bson_type ,
14591467 max - (int )key_size , as_class , tz_aware , uuid_subtype );
14601468 if (!to_append ) {
@@ -1659,15 +1667,18 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
16591667 int flags ;
16601668 size_t flags_length , i ;
16611669 size_t pattern_length = strlen (buffer + * position );
1662- if (max < pattern_length ) {
1670+ if (max < pattern_length || pattern_length > BSON_MAX_SIZE ) {
16631671 goto invalid ;
16641672 }
16651673 pattern = PyUnicode_DecodeUTF8 (buffer + * position , pattern_length , "strict" );
16661674 if (!pattern ) {
16671675 return NULL ;
16681676 }
1669- * position += pattern_length + 1 ;
1670- flags_length = strlen (buffer + * position );
1677+ * position += (int )pattern_length + 1 ;
1678+ if ((flags_length = strlen (buffer + * position )) > BSON_MAX_SIZE ) {
1679+ Py_DECREF (pattern );
1680+ goto invalid ;
1681+ }
16711682 if (max < pattern_length + flags_length ) {
16721683 Py_DECREF (pattern );
16731684 goto invalid ;
@@ -1688,7 +1699,7 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
16881699 flags |= 64 ;
16891700 }
16901701 }
1691- * position += flags_length + 1 ;
1702+ * position += ( int ) flags_length + 1 ;
16921703 value = PyObject_CallFunction (state -> RECompile , "Oi" , pattern , flags );
16931704 Py_DECREF (pattern );
16941705 break ;
@@ -1701,14 +1712,14 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
17011712
17021713 * position += 4 ;
17031714 collection_length = strlen (buffer + * position );
1704- if (max < collection_length ) {
1715+ if (max < collection_length || collection_length > BSON_MAX_SIZE ) {
17051716 goto invalid ;
17061717 }
17071718 collection = PyUnicode_DecodeUTF8 (buffer + * position , collection_length , "strict" );
17081719 if (!collection ) {
17091720 return NULL ;
17101721 }
1711- * position += collection_length + 1 ;
1722+ * position += ( int ) collection_length + 1 ;
17121723 if (max < collection_length + 12 ) {
17131724 Py_DECREF (collection );
17141725 goto invalid ;
@@ -1750,14 +1761,14 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
17501761
17511762 * position += 8 ;
17521763 code_length = strlen (buffer + * position );
1753- if (max < 8 + code_length ) {
1764+ if (max < 8 + code_length || code_length > BSON_MAX_SIZE ) {
17541765 goto invalid ;
17551766 }
17561767 code = PyUnicode_DecodeUTF8 (buffer + * position , code_length , "strict" );
17571768 if (!code ) {
17581769 return NULL ;
17591770 }
1760- * position += code_length + 1 ;
1771+ * position += ( int ) code_length + 1 ;
17611772
17621773 memcpy (& scope_size , buffer + * position , 4 );
17631774 scope = elements_to_dict (self , buffer + * position + 4 , scope_size - 5 ,
@@ -1866,7 +1877,7 @@ static PyObject* elements_to_dict(PyObject* self, const char* string, int max,
18661877 PyObject * value ;
18671878 int type = (int )string [position ++ ];
18681879 size_t name_length = strlen (string + position );
1869- if (position + name_length >= max ) {
1880+ if (name_length > BSON_MAX_SIZE || position + name_length >= max ) {
18701881 PyObject * InvalidBSON = _error ("InvalidBSON" );
18711882 if (InvalidBSON ) {
18721883 PyErr_SetNone (InvalidBSON );
@@ -1880,7 +1891,7 @@ static PyObject* elements_to_dict(PyObject* self, const char* string, int max,
18801891 Py_DECREF (dict );
18811892 return NULL ;
18821893 }
1883- position += name_length + 1 ;
1894+ position += ( int ) name_length + 1 ;
18841895 value = get_value (self , string , & position , type ,
18851896 max - position , as_class , tz_aware , uuid_subtype );
18861897 if (!value ) {
0 commit comments