@@ -380,16 +380,13 @@ _mongoc_write_command_update_legacy (mongoc_write_command_t *command,
380
380
int32_t max_bson_obj_size ;
381
381
mongoc_rpc_t rpc ;
382
382
uint32_t request_id = 0 ;
383
- bson_iter_t subiter , subsubiter ;
384
- bson_t doc ;
383
+ bson_iter_t subiter ;
385
384
bson_t update , selector ;
386
385
const uint8_t * data = NULL ;
387
386
uint32_t len = 0 ;
388
- size_t err_offset ;
389
387
bool val = false;
390
388
char * ns ;
391
- int vflags = (BSON_VALIDATE_UTF8 | BSON_VALIDATE_UTF8_ALLOW_NULL |
392
- BSON_VALIDATE_DOLLAR_KEYS | BSON_VALIDATE_DOT_KEYS );
389
+ bool r ;
393
390
bson_reader_t * reader ;
394
391
const bson_t * bson ;
395
392
bool eof ;
@@ -406,45 +403,20 @@ _mongoc_write_command_update_legacy (mongoc_write_command_t *command,
406
403
407
404
max_bson_obj_size = mongoc_server_stream_max_bson_obj_size (server_stream );
408
405
409
- reader =
410
- bson_reader_new_from_data (command -> payload .data , command -> payload .len );
411
- while ((bson = bson_reader_read (reader , & eof ))) {
412
- if (bson_iter_init (& subiter , bson ) && bson_iter_find (& subiter , "u" ) &&
413
- BSON_ITER_HOLDS_DOCUMENT (& subiter )) {
414
- bson_iter_document (& subiter , & len , & data );
415
- BSON_ASSERT (bson_init_static (& doc , data , len ));
416
-
417
- if (bson_iter_init (& subsubiter , & doc ) &&
418
- bson_iter_next (& subsubiter ) &&
419
- (bson_iter_key (& subsubiter )[0 ] != '$' ) &&
420
- !bson_validate (
421
- & doc , (bson_validate_flags_t ) vflags , & err_offset )) {
422
- result -> failed = true;
423
- bson_set_error (error ,
424
- MONGOC_ERROR_BSON ,
425
- MONGOC_ERROR_BSON_INVALID ,
426
- "update document is corrupt or contains "
427
- "invalid keys including $ or ." );
428
- bson_reader_destroy (reader );
429
- EXIT ;
430
- }
431
- } else {
432
- result -> failed = true;
433
- bson_set_error (error ,
434
- MONGOC_ERROR_BSON ,
435
- MONGOC_ERROR_BSON_INVALID ,
436
- "updates is malformed." );
437
- bson_reader_destroy (reader );
438
- EXIT ;
439
- }
440
- }
441
-
442
406
ns = bson_strdup_printf ("%s.%s" , database , collection );
443
407
444
408
bson_reader_destroy (reader );
445
409
reader =
446
410
bson_reader_new_from_data (command -> payload .data , command -> payload .len );
447
411
while ((bson = bson_reader_read (reader , & eof ))) {
412
+ /* ensure the document has "q" and "u" document fields */
413
+ r = (bson_iter_init (& subiter , bson ) && bson_iter_find (& subiter , "q" ) &&
414
+ BSON_ITER_HOLDS_DOCUMENT (& subiter ) &&
415
+ bson_iter_find (& subiter , "u" ) &&
416
+ BSON_ITER_HOLDS_DOCUMENT (& subiter ));
417
+
418
+ BSON_ASSERT (r );
419
+
448
420
request_id = ++ client -> cluster .request_id ;
449
421
450
422
rpc .header .msg_len = 0 ;
@@ -459,6 +431,10 @@ _mongoc_write_command_update_legacy (mongoc_write_command_t *command,
459
431
while (bson_iter_next (& subiter )) {
460
432
if (strcmp (bson_iter_key (& subiter ), "u" ) == 0 ) {
461
433
bson_iter_document (& subiter , & len , & data );
434
+
435
+ BSON_ASSERT (data );
436
+ BSON_ASSERT (len >= 5 );
437
+
462
438
if (len > max_bson_obj_size ) {
463
439
_mongoc_write_command_too_large_error (
464
440
error , 0 , len , max_bson_obj_size );
@@ -472,6 +448,10 @@ _mongoc_write_command_update_legacy (mongoc_write_command_t *command,
472
448
BSON_ASSERT (bson_init_static (& update , data , len ));
473
449
} else if (strcmp (bson_iter_key (& subiter ), "q" ) == 0 ) {
474
450
bson_iter_document (& subiter , & len , & data );
451
+
452
+ BSON_ASSERT (data );
453
+ BSON_ASSERT (len >= 5 );
454
+
475
455
if (len > max_bson_obj_size ) {
476
456
_mongoc_write_command_too_large_error (
477
457
error , 0 , len , max_bson_obj_size );
0 commit comments