Merge remote-tracking branch 'upstream/master' into DRIVERS-3546

Author: blink1073

CHANGELOG.md

@@ -1,6 +1,10 @@
 # ChangeLog
 
-## Unreleased
+## 1.20.0 [Unreleased]
+
+<!-- TODO: add entries for next release -->
+
+## 1.19.0
 
 ### Added
 - Stable support for prefix and suffix queries:
@@ -11,7 +15,12 @@
 ### Removed
 - Support for the experimental `prefixPreview` and `suffixPreview` query types.
 
-<!-- TODO: add entries for next release -->
+
+## 1.18.2
+
+### Fixed
+- Add musl arm64 release to GitHub release. This was an omission in 1.18.0.
+- Reject large KMS replies.
 
 ## 1.18.1
 

bindings/python/pymongocrypt/version.py

@@ -12,6 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "1.18.1"
+__version__ = "1.18.2.dev0"
 
 _MIN_LIBMONGOCRYPT_VERSION = "1.8.0"

etc/cyclonedx.sbom.json

@@ -57,7 +57,7 @@
     }
   ],
   "metadata": {
-    "timestamp": "2026-05-01T14:49:06.464175+00:00",
+    "timestamp": "2026-06-05T18:21:36.076717+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,7 +100,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:5c89265b-cc3d-4649-878b-17b482325b56",
+  "serialNumber": "urn:uuid:30a59905-5ec6-4cb7-b14d-51382db97651",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

kms-message/src/kms_kmip_response_parser.c

@@ -111,6 +111,10 @@ kms_kmip_response_parser_feed (kms_kmip_response_parser_t *parser,
       uint32_t temp;
       memcpy (&temp, parser->buf->str + FIRST_LENGTH_OFFSET, sizeof (uint32_t));
       parser->first_len = KMS_UINT32_FROM_BE (temp);
+      if (parser->first_len > KMS_PARSER_MAX_RESPONSE_LEN) {
+         KMS_ERROR (parser, "KMS KMIP response too large");
+         return false;
+      }
    }
    return true;
 }

test/test-mongocrypt-kms-ctx.c

@@ -20,6 +20,7 @@
 #include "mongocrypt-key-private.h"
 #include "mongocrypt-kms-ctx-private.h"
 #include "mongocrypt-private.h"
+#include "test-mongocrypt-assert.h"
 #include "test-mongocrypt-util.h"
 #include "test-mongocrypt.h"
 
@@ -885,6 +886,100 @@ static void _test_mongocrypt_kms_ctx_feed_empty_bytes(_mongocrypt_tester_t *test
     mongocrypt_status_destroy(status);
 }
 
+// _test_mongocrypt_kms_ctx_kmip_response_bad_length tests KMIP responses that report bad lengths.
+static void _test_mongocrypt_kms_ctx_kmip_response_bad_length(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    bool ok;
+    uint8_t secretdata[KMS_KMIP_REQUEST_SECRETDATA_LENGTH] = {0};
+    mongocrypt_status_t *status = mongocrypt_status_new();
+    _mongocrypt_endpoint_t *endpoint = _mongocrypt_endpoint_new("example.com", -1, NULL /* opts */, status);
+    ASSERT_OK_STATUS(endpoint != NULL, status);
+
+    // Regression test for MONGOCRYPT-909: test UINT32_MAX
+    {
+        mongocrypt_kms_ctx_t kms_ctx = {0};
+        static const char *kmip_header = "\x42\x00\x7b\x01"  // Tag=ResponseMessage, Type=Structure
+                                         "\xff\xff\xff\xff"; // Length = UINT32_MAX
+
+        ok = _mongocrypt_kms_ctx_init_kmip_register(&kms_ctx,
+                                                    endpoint,
+                                                    secretdata,
+                                                    KMS_KMIP_REQUEST_SECRETDATA_LENGTH,
+                                                    "kmip",
+                                                    &crypt->log);
+        ASSERT_OK_STATUS(ok, kms_ctx.status);
+
+        // Parser requests 8 bytes for initial header:
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 8u);
+
+        mongocrypt_binary_t *bytes = mongocrypt_binary_new_from_data((uint8_t *)kmip_header, 8u);
+
+        // Expect error (not abort):
+        ASSERT_FAILS(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx, "KMS KMIP response too large");
+
+        mongocrypt_binary_destroy(bytes);
+        _mongocrypt_kms_ctx_cleanup(&kms_ctx);
+    }
+
+    // Length reported is less than data fed.
+    {
+        mongocrypt_kms_ctx_t kms_ctx = {0};
+        static const char *kmip_header = "\x42\x00\x7b\x01"  // Tag=ResponseMessage, Type=Structure
+                                         "\x00\x00\x00\x01"; // Length = 1
+        ASSERT_OK_STATUS(endpoint != NULL, status);
+
+        ok = _mongocrypt_kms_ctx_init_kmip_register(&kms_ctx,
+                                                    endpoint,
+                                                    secretdata,
+                                                    KMS_KMIP_REQUEST_SECRETDATA_LENGTH,
+                                                    "kmip",
+                                                    &crypt->log);
+        ASSERT_OK_STATUS(ok, kms_ctx.status);
+
+        // Parser requests 8 bytes for initial header:
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 8u);
+
+        mongocrypt_binary_t *bytes = mongocrypt_binary_new_from_data((uint8_t *)kmip_header, 8u);
+        ASSERT_OK(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx);
+
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 1u);
+        // Attempting to feed more data errors.
+        ASSERT_FAILS(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx, "KMS response fed too much data");
+
+        mongocrypt_binary_destroy(bytes);
+        _mongocrypt_kms_ctx_cleanup(&kms_ctx);
+    }
+
+    // Length reported is zero.
+    {
+        mongocrypt_kms_ctx_t kms_ctx = {0};
+        static const char *kmip_header = "\x42\x00\x7b\x01"  // Tag=ResponseMessage, Type=Structure
+                                         "\x00\x00\x00\x00"; // Length = 0
+        ASSERT_OK_STATUS(endpoint != NULL, status);
+
+        ok = _mongocrypt_kms_ctx_init_kmip_register(&kms_ctx,
+                                                    endpoint,
+                                                    secretdata,
+                                                    KMS_KMIP_REQUEST_SECRETDATA_LENGTH,
+                                                    "kmip",
+                                                    &crypt->log);
+        ASSERT_OK_STATUS(ok, kms_ctx.status);
+
+        // Parser requests 8 bytes for initial header:
+        ASSERT_CMPINT(mongocrypt_kms_ctx_bytes_needed(&kms_ctx), ==, 8u);
+
+        mongocrypt_binary_t *bytes = mongocrypt_binary_new_from_data((uint8_t *)kmip_header, 8u);
+        ASSERT_FAILS(mongocrypt_kms_ctx_feed(&kms_ctx, bytes), &kms_ctx, "Error getting UniqueIdentifer");
+
+        mongocrypt_binary_destroy(bytes);
+        _mongocrypt_kms_ctx_cleanup(&kms_ctx);
+    }
+
+    _mongocrypt_endpoint_destroy(endpoint);
+    mongocrypt_status_destroy(status);
+    mongocrypt_destroy(crypt);
+}
+
 void _mongocrypt_tester_install_kms_ctx(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_mongocrypt_kms_ctx_kmip_register);
     INSTALL_TEST(_test_mongocrypt_kms_ctx_kmip_activate);
@@ -895,4 +990,5 @@ void _mongocrypt_tester_install_kms_ctx(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_mongocrypt_kms_ctx_get_kms_provider);
     INSTALL_TEST(_test_mongocrypt_kms_ctx_default_port);
     INSTALL_TEST(_test_mongocrypt_kms_ctx_feed_empty_bytes);
+    INSTALL_TEST(_test_mongocrypt_kms_ctx_kmip_response_bad_length);
 }