CVE-2020-12135 (published 2020-04-24T01:15Z)

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/10gen-archive/mongo-c-driver-legacy
commit_details: repo_url: https://github.com/10gen-archive/mongo-c-driver-legacy
author: Jérôme Lebel
author_date: 2013-01-07 22:30:02+01:00
msg: don't mix up int and size_t (first pass to fix that)
repository: repo_url: https://github.com/10gen-archive/mongo-c-driver-legacy
repo_name: 10gen-archive/mongo-c-driver-legacy
description: C Driver for MongoDB
repo_language: C
owner: 10gen-archive
file_changes: filename: bcon.c
change_type: ModificationType.MODIFY
diff: @@ -172,7 +172,7 @@ static bcon_error_t bson_append_bcon_with_state(bson *b, const bcon *bc, bcon_st
     unsigned char doc_stack[DOC_STACK_SIZE];
     size_t doc_stack_pointer = 0;
     size_t array_index = 0;
-    unsigned int array_index_stack[ARRAY_INDEX_STACK_SIZE];
+    size_t array_index_stack[ARRAY_INDEX_STACK_SIZE];
     size_t array_index_stack_pointer = 0;
     char array_index_buffer[ARRAY_INDEX_BUFFER_SIZE]; /* max BSON size */
     int end_of_data;

programming_language: C
filename: bson.c
change_type: ModificationType.MODIFY
diff: @@ -106,7 +106,7 @@ MONGO_EXPORT int bson_size( const bson *b ) {
     return i;
 }
 
-MONGO_EXPORT int bson_buffer_size( const bson *b ) {
+MONGO_EXPORT size_t bson_buffer_size( const bson *b ) {
     return (b->cur - b->data + 1);
 }
 
@@ -306,7 +306,7 @@ MONGO_EXPORT bson_bool_t bson_iterator_more( const bson_iterator *i ) {
 }
 
 MONGO_EXPORT bson_type bson_iterator_next( bson_iterator *i ) {
-    int ds;
+    size_t ds;
 
     if ( i->first ) {
         i->first = 0;
@@ -420,7 +420,7 @@ MONGO_EXPORT int bson_iterator_int( const bson_iterator *i ) {
     case BSON_INT:
         return bson_iterator_int_raw( i );
     case BSON_LONG:
-        return bson_iterator_long_raw( i );
+        return ( int )bson_iterator_long_raw( i );
     case BSON_DOUBLE:
         return bson_iterator_double_raw( i );
     default:
@@ -604,7 +604,7 @@ static void bson_append_byte( bson *b, char c ) {
     b->cur++;
 }
 
-static void bson_append( bson *b, const void *data, int len ) {
+static void bson_append( bson *b, const void *data, size_t len ) {
     memcpy( b->cur , data , len );
     b->cur += len;
 }
@@ -614,12 +614,17 @@ static void bson_append32( bson *b, const void *data ) {
     b->cur += 4;
 }
 
+static void bson_append32_as_int( bson *b, int data ) {
+    bson_little_endian32( b->cur, &data );
+    b->cur += 4;
+}
+
 static void bson_append64( bson *b, const void *data ) {
     bson_little_endian64( b->cur, data );
     b->cur += 8;
 }
 
-int bson_ensure_space( bson *b, const int bytesNeeded ) {
+int bson_ensure_space( bson *b, const size_t bytesNeeded ) {
     int pos = b->cur - b->data;
     char *orig = b->data;
     int new_size;
@@ -657,7 +662,7 @@ MONGO_EXPORT int bson_finish( bson *b ) {
     if ( ! b->finished ) {
         if ( bson_ensure_space( b, 1 ) == BSON_ERROR ) return BSON_ERROR;
         bson_append_byte( b, 0 );
-        i = b->cur - b->data;
+        i = ( int )( b->cur - b->data );
         bson_little_endian32( b->data, &i );
         b->finished = 1;
     }
@@ -675,7 +680,7 @@ MONGO_EXPORT void bson_destroy( bson *b ) {
     }
 }
 
-static int bson_append_estart( bson *b, int type, const char *name, const int dataSize ) {
+static int bson_append_estart( bson *b, int type, const char *name, const size_t dataSize ) {
     const int len = strlen( name ) + 1;
 
     if ( b->finished ) {
@@ -742,15 +747,15 @@ MONGO_EXPORT int bson_append_undefined( bson *b, const char *name ) {
 }
 
 static int bson_append_string_base( bson *b, const char *name,
-                                    const char *value, int len, bson_type type ) {
+                                    const char *value, size_t len, bson_type type ) {
 
-    int sl = len + 1;
+    size_t sl = len + 1;
     if ( bson_check_string( b, ( const char * )value, sl - 1 ) == BSON_ERROR )
         return BSON_ERROR;
     if ( bson_append_estart( b, type, name, 4 + sl ) == BSON_ERROR ) {
         return BSON_ERROR;
     }
-    bson_append32( b , &sl );
+    bson_append32_as_int( b , ( int )sl );
     bson_append( b , value , sl - 1 );
     bson_append( b , "\0" , 1 );
     return BSON_OK;
@@ -768,28 +773,28 @@ MONGO_EXPORT int bson_append_code( bson *b, const char *name, const char *value
     return bson_append_string_base( b, name, value, strlen ( value ), BSON_CODE );
 }
 
-MONGO_EXPORT int bson_append_string_n( bson *b, const char *name, const char *value, int len ) {
+MONGO_EXPORT int bson_append_string_n( bson *b, const char *name, const char *value, size_t len ) {
     return bson_append_string_base( b, name, value, len, BSON_STRING );
 }
 
-MONGO_EXPORT int bson_append_symbol_n( bson *b, const char *name, const char *value, int len ) {
+MONGO_EXPORT int bson_append_symbol_n( bson *b, const char *name, const char *value, size_t len ) {
     return bson_append_string_base( b, name, value, len, BSON_SYMBOL );
 }
 
-MONGO_EXPORT int bson_append_code_n( bson *b, const char *name, const char *value, int len ) {
+MONGO_EXPORT int bson_append_code_n( bson *b, const char *name, const char *value, size_t len ) {
     return bson_append_string_base( b, name, value, len, BSON_CODE );
 }
 
 MONGO_EXPORT int bson_append_code_w_scope_n( bson *b, const char *name,
-        const char *code, int len, const bson *scope ) {
+        const char *code, size_t len, const bson *scope ) {
 
-    int sl, size;
+    size_t sl, size;
     if ( !scope ) return BSON_ERROR;
     sl = len + 1;
     size = 4 + 4 + sl + bson_size( scope );
     if ( bson_append_estart( b, BSON_CODEWSCOPE, name, size ) == BSON_ERROR )
         return BSON_ERROR;
-    bson_append32( b, &size );
+    bson_append32_as_int( b, ( int )size );
     bson_append32( b, &sl );
     bson_append( b, code, sl );
     bson_append( b, scope->data, bson_size( scope ) );
@@ -800,20 +805,20 @@ MONGO_EXPORT int bson_append_code_w_scope( bson *b, const char *name, const char
     return bson_append_code_w_scope_n( b, name, code, strlen ( code ), scope );
 }
 
-MONGO_EXPORT int bson_append_binary( bson *b, const char *name, char type, const char *str, int len ) {
+MONGO_EXPORT int bson_append_binary( bson *b, const char *name, char type, const char *str, size_t len ) {
     if ( type == BSON_BIN_BINARY_OLD ) {
         int subtwolen = len + 4;
         if ( bson_append_estart( b, BSON_BINDATA, name, 4+1+4+len ) == BSON_ERROR )
             return BSON_ERROR;
-        bson_append32( b, &subtwolen );
+        bson_append32_as_int( b, ( int )subtwolen );
         bson_append_byte( b, type );
-        bson_append32( b, &len );
+        bson_append32_as_int( b, ( int )len );
         bson_append( b, str, len );
     }
     else {
         if ( bson_append_estart( b, BSON_BINDATA, name, 4+1+len ) == BSON_ERROR )
             return BSON_ERROR;
-        bson_append32( b, &len );
+        bson_append32_as_int( b, ( int )len );
         bson_append_byte( b, type );
         bson_append( b, str, len );
     }
@@ -834,8 +839,8 @@ MONGO_EXPORT int bson_append_new_oid( bson *b, const char *name ) {
 }
 
 MONGO_EXPORT int bson_append_regex( bson *b, const char *name, const char *pattern, const char *opts ) {
-    const int plen = strlen( pattern )+1;
-    const int olen = strlen( opts )+1;
+    const size_t plen = strlen( pattern )+1;
+    const size_t olen = strlen( opts )+1;
     if ( bson_append_estart( b, BSON_REGEX, name, plen + olen ) == BSON_ERROR )
         return BSON_ERROR;
     if ( bson_check_string( b, pattern, plen - 1 ) == BSON_ERROR )
@@ -855,7 +860,7 @@ MONGO_EXPORT int bson_append_bson( bson *b, const char *name, const bson *bson )
 
 MONGO_EXPORT int bson_append_element( bson *b, const char *name_or_null, const bson_iterator *elem ) {
     bson_iterator next = *elem;
-    int size;
+    size_t size;
 
     bson_iterator_next( &next );
     size = next.cur - elem->cur;
@@ -866,7 +871,7 @@ MONGO_EXPORT int bson_append_element( bson *b, const char *name_or_null, const b
         bson_append( b, elem->cur, size );
     }
     else {
-        int data_size = size - 2 - strlen( bson_iterator_key( elem ) );
+        size_t data_size = size - 2 - strlen( bson_iterator_key( elem ) );
         bson_append_estart( b, elem->cur[0], name_or_null, data_size );
         bson_append( b, bson_iterator_value( elem ), data_size );
     }
@@ -922,7 +927,7 @@ MONGO_EXPORT int bson_append_finish_object( bson *b ) {
     bson_append_byte( b , 0 );
 
     start = b->data + b->stack[ --b->stackPos ];
-    i = b->cur - start;
+    i = ( int )( b->cur - start );
     bson_little_endian32( start, &i );
 
     return BSON_OK;
@@ -950,14 +955,14 @@ MONGO_EXPORT void bson_free( void *ptr ) {
     bson_free_func( ptr );
 }
 
-MONGO_EXPORT void *bson_malloc( int size ) {
+MONGO_EXPORT void *bson_malloc( size_t size ) {
     void *p;
     p = bson_malloc_func( size );
     bson_fatal_msg( !!p, "malloc() failed" );
     return p;
 }
 
-void *bson_realloc( void *ptr, int size ) {
+void *bson_realloc( void *ptr, size_t size ) {
     void *p;
     p = bson_realloc_func( ptr, size );
     bson_fatal_msg( !!p, "realloc() failed" );

programming_language: C++
filename: bson.h
change_type: ModificationType.MODIFY
diff: @@ -135,7 +135,7 @@ typedef struct {
     char *cur;     /**< Pointer to the current position. */
     int dataSize;  /**< The number of bytes allocated to char *data. */
     bson_bool_t finished; /**< When finished, the BSON object can no longer be modified. */
-    int stack[32];        /**< A stack used to keep track of nested BSON elements. */
+    size_t stack[32];        /**< A stack used to keep track of nested BSON elements. */
     int stackPos;         /**< Index of current stack position. */
     int err; /**< Bitfield representing errors or warnings on this buffer */
     char *errstr; /**< A string representation of the most recent error or warning. */
@@ -170,7 +170,7 @@ MONGO_EXPORT void  bson_dispose(bson* b);
  * @return the size.
  */
 MONGO_EXPORT int bson_size( const bson *b );
-MONGO_EXPORT int bson_buffer_size( const bson *b );
+MONGO_EXPORT size_t bson_buffer_size( const bson *b );
 
 /**
  * Print a string representation of a BSON object.
@@ -602,7 +602,7 @@ void bson_init_size( bson *b, int size );
  * @return BSON_OK or BSON_ERROR with the bson error object set.
  *   Exits if allocation fails.
  */
-int bson_ensure_space( bson *b, const int bytesNeeded );
+int bson_ensure_space( bson *b, const size_t bytesNeeded );
 
 /**
  * Finalize a bson object.
@@ -717,7 +717,7 @@ MONGO_EXPORT int bson_append_string( bson *b, const char *name, const char *str
  *
  * @return BSON_OK or BSON_ERROR.
  */
-MONGO_EXPORT int bson_append_string_n( bson *b, const char *name, const char *str, int len );
+MONGO_EXPORT int bson_append_string_n( bson *b, const char *name, const char *str, size_t len );
 
 /**
  * Append a symbol to a bson.
@@ -740,7 +740,7 @@ MONGO_EXPORT int bson_append_symbol( bson *b, const char *name, const char *str
  *
  * @return BSON_OK or BSON_ERROR.
  */
-MONGO_EXPORT int bson_append_symbol_n( bson *b, const char *name, const char *str, int len );
+MONGO_EXPORT int bson_append_symbol_n( bson *b, const char *name, const char *str, size_t len );
 
 /**
  * Append code to a bson.
@@ -764,7 +764,7 @@ MONGO_EXPORT int bson_append_code( bson *b, const char *name, const char *str );
  *
  * @return BSON_OK or BSON_ERROR.
  */
-MONGO_EXPORT int bson_append_code_n( bson *b, const char *name, const char *str, int len );
+MONGO_EXPORT int bson_append_code_n( bson *b, const char *name, const char *str, size_t len );
 
 /**
  * Append code to a bson with scope.
@@ -789,7 +789,7 @@ MONGO_EXPORT int bson_append_code_w_scope( bson *b, const char *name, const char
  *
  * @return BSON_OK or BSON_ERROR.
  */
-MONGO_EXPORT int bson_append_code_w_scope_n( bson *b, const char *name, const char *code, int size, const bson *scope );
+MONGO_EXPORT int bson_append_code_w_scope_n( bson *b, const char *name, const char *code, size_t size, const bson *scope );
 
 /**
  * Append binary data to a bson.
@@ -802,7 +802,7 @@ MONGO_EXPORT int bson_append_code_w_scope_n( bson *b, const char *name, const ch
  *
  * @return BSON_OK or BSON_ERROR.
  */
-MONGO_EXPORT int bson_append_binary( bson *b, const char *name, char type, const char *str, int len );
+MONGO_EXPORT int bson_append_binary( bson *b, const char *name, char type, const char *str, size_t len );
 
 /**
  * Append a bson_bool_t to a bson.
@@ -977,7 +977,7 @@ MONGO_EXPORT void bson_free( void *ptr );
  *
  * @sa malloc(3)
  */
-MONGO_EXPORT void *bson_malloc( int size );
+MONGO_EXPORT void *bson_malloc( size_t size );
 
 /**
  * Changes the size of allocated memory and checks return value,
@@ -990,7 +990,7 @@ MONGO_EXPORT void *bson_malloc( int size );
  *
  * @sa realloc()
  */
-void *bson_realloc( void *ptr, int size );
+void *bson_realloc( void *ptr, size_t size );
 
 /**
  * Set a function for error handling.

programming_language: C
filename: encoding.c
change_type: ModificationType.MODIFY
diff: @@ -102,7 +102,7 @@ static int isLegalUTF8( const unsigned char *source, int length ) {
 }
 
 /* If the name is part of a db ref ($ref, $db, or $id), then return true. */
-static int bson_string_is_db_ref( const unsigned char *string, const int length ) {
+static int bson_string_is_db_ref( const unsigned char *string, const size_t length ) {
     int result = 0;
 
     if( length >= 4 ) {
@@ -120,10 +120,10 @@ static int bson_string_is_db_ref( const unsigned char *string, const int length
 }
 
 static int bson_validate_string( bson *b, const unsigned char *string,
-                                 const int length, const char check_utf8, const char check_dot,
+                                 const size_t length, const char check_utf8, const char check_dot,
                                  const char check_dollar ) {
 
-    int position = 0;
+    size_t position = 0;
     int sequence_length = 1;
 
     if( check_dollar && string[0] == '$' ) {
@@ -155,13 +155,13 @@ static int bson_validate_string( bson *b, const unsigned char *string,
 
 
 int bson_check_string( bson *b, const char *string,
-                       const int length ) {
+                       const size_t length ) {
 
     return bson_validate_string( b, ( const unsigned char * )string, length, 1, 0, 0 );
 }
 
 int bson_check_field_name( bson *b, const char *string,
-                           const int length ) {
+                           const size_t length ) {
 
     return bson_validate_string( b, ( const unsigned char * )string, length, 1, 1, 1 );
 }

programming_language: C
filename: encoding.h
change_type: ModificationType.MODIFY
diff: @@ -35,7 +35,7 @@ MONGO_EXTERN_C_START
  *     Set the value of b->err appropriately.
  */
 int bson_check_field_name( bson *b, const char *string,
-                           const int length );
+                           const size_t length );
 
 /**
  * Check that a string is valid UTF8. Sets the buffer bit field appropriately.
@@ -48,7 +48,7 @@ int bson_check_field_name( bson *b, const char *string,
  *     Sets b->err on error.
  */
 bson_bool_t bson_check_string( bson *b, const char *string,
-                               const int length );
+                               const size_t length );
 
 MONGO_EXTERN_C_END
 #endif

programming_language: Scala
filename: env.c
change_type: ModificationType.MODIFY
diff: @@ -38,12 +38,12 @@ int mongo_env_close_socket( int socket ) {
     return closesocket( socket );
 }
 
-int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
+int mongo_env_write_socket( mongo *conn, const void *buf, size_t len ) {
     const char *cbuf = buf;
     int flags = 0;
 
     while ( len ) {
-        int sent = send( conn->sock, cbuf, len, flags );
+        size_t sent = send( conn->sock, cbuf, len, flags );
         if ( sent == -1 ) {
             __mongo_set_error( conn, MONGO_IO_ERROR, NULL, WSAGetLastError() );
             conn->connected = 0;
@@ -56,11 +56,11 @@ int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
     return MONGO_OK;
 }
 
-int mongo_env_read_socket( mongo *conn, void *buf, int len ) {
+int mongo_env_read_socket( mongo *conn, void *buf, size_t len ) {
     char *cbuf = buf;
 
     while ( len ) {
-        int sent = recv( conn->sock, cbuf, len, 0 );
+        size_t sent = recv( conn->sock, cbuf, len, 0 );
         if ( sent == 0 || sent == -1 ) {
             __mongo_set_error( conn, MONGO_IO_ERROR, NULL, WSAGetLastError() );
             return MONGO_ERROR;
@@ -225,7 +225,7 @@ int mongo_env_sock_init( void ) {
     return 0;
 }
 
-int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
+int mongo_env_write_socket( mongo *conn, const void *buf, size_t len ) {
     const char *cbuf = buf;
 #ifdef __APPLE__
     int flags = 0;
@@ -234,7 +234,7 @@ int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
 #endif
 
     while ( len ) {
-        int sent = send( conn->sock, cbuf, len, flags );
+        size_t sent = send( conn->sock, cbuf, len, flags );
         if ( sent == -1 ) {
             if (errno == EPIPE)
                 conn->connected = 0;
@@ -248,10 +248,10 @@ int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
     return MONGO_OK;
 }
 
-int mongo_env_read_socket( mongo *conn, void *buf, int len ) {
+int mongo_env_read_socket( mongo *conn, void *buf, size_t len ) {
     char *cbuf = buf;
     while ( len ) {
-        int sent = recv( conn->sock, cbuf, len, 0 );
+        size_t sent = recv( conn->sock, cbuf, len, 0 );
         if ( sent == 0 || sent == -1 ) {
             __mongo_set_error( conn, MONGO_IO_ERROR, strerror( errno ), errno );
             return MONGO_ERROR;
@@ -443,7 +443,7 @@ int mongo_env_close_socket( int socket ) {
 #endif
 }
 
-int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
+int mongo_env_write_socket( mongo *conn, const void *buf, size_t len ) {
     const char *cbuf = buf;
 #ifdef _WIN32
     int flags = 0;
@@ -456,7 +456,7 @@ int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
 #endif
 
     while ( len ) {
-        int sent = send( conn->sock, cbuf, len, flags );
+        size_t sent = send( conn->sock, cbuf, len, flags );
         if ( sent == -1 ) {
             if (errno == EPIPE)
                 conn->connected = 0;
@@ -470,10 +470,10 @@ int mongo_env_write_socket( mongo *conn, const void *buf, int len ) {
     return MONGO_OK;
 }
 
-int mongo_env_read_socket( mongo *conn, void *buf, int len ) {
+int mongo_env_read_socket( mongo *conn, void *buf, size_t len ) {
     char *cbuf = buf;
     while ( len ) {
-        int sent = recv( conn->sock, cbuf, len, 0 );
+        size_t sent = recv( conn->sock, cbuf, len, 0 );
         if ( sent == 0 || sent == -1 ) {
             conn->err = MONGO_IO_ERROR;
             return MONGO_ERROR;

programming_language: C
filename: env.h
change_type: ModificationType.MODIFY
diff: @@ -25,8 +25,8 @@ MONGO_EXTERN_C_START
 
 /* This is a no-op in the generic implementation. */
 int mongo_env_set_socket_op_timeout( mongo *conn, int millis );
-int mongo_env_read_socket( mongo *conn, void *buf, int len );
-int mongo_env_write_socket( mongo *conn, const void *buf, int len );
+int mongo_env_read_socket( mongo *conn, void *buf, size_t len );
+int mongo_env_write_socket( mongo *conn, const void *buf, size_t len );
 int mongo_env_socket_connect( mongo *conn, const char *host, int port );
 
 /* Initialize socket services */

programming_language: C
filename: gridfs.c
change_type: ModificationType.MODIFY
diff: @@ -228,9 +228,9 @@ MONGO_EXPORT void gridfile_writer_init( gridfile *gfile, gridfs *gfs,
 MONGO_EXPORT void gridfile_write_buffer( gridfile *gfile, const char *data,
         gridfs_offset length ) {
 
-    int bytes_left = 0;
-    int data_partial_len = 0;
-    int chunks_to_write = 0;
+    size_t bytes_left = 0;
+    size_t data_partial_len = 0;
+    size_t chunks_to_write = 0;
     char *buffer;
     bson *oChunk;
     gridfs_offset to_write = length + gfile->pending_len;
@@ -590,7 +590,7 @@ MONGO_EXPORT void gridfile_get_chunk( gridfile *gfile, int n, bson* out ) {
     }
 }
 
-MONGO_EXPORT mongo_cursor *gridfile_get_chunks( gridfile *gfile, int start, int size ) {
+MONGO_EXPORT mongo_cursor *gridfile_get_chunks( gridfile *gfile, int start, size_t size ) {
     bson_iterator it;
     bson_oid_t id;
     bson gte;
@@ -605,11 +605,11 @@ MONGO_EXPORT mongo_cursor *gridfile_get_chunks( gridfile *gfile, int start, int
     bson_init( &query );
     bson_append_oid( &query, "files_id", &id );
     if ( size == 1 ) {
-        bson_append_int( &query, "n", start );
+        bson_append_int( &query, "n", (int)start );
     }
     else {
         bson_init( &gte );
-        bson_append_int( &gte, "$gte", start );
+        bson_append_int( &gte, "$gte", (int)start );
         bson_finish( &gte );
         bson_append_bson( &query, "n", &gte );
         bson_destroy( &gte );
@@ -626,7 +626,7 @@ MONGO_EXPORT mongo_cursor *gridfile_get_chunks( gridfile *gfile, int start, int
     bson_finish( &command );
 
     cursor = mongo_find( gfile->gfs->client, gfile->gfs->chunks_ns,
-                         &command, NULL, size, 0, 0 );
+                         &command, NULL, (int)size, 0, 0 );
 
     bson_destroy( &command );
     bson_destroy( &query );
@@ -659,9 +659,9 @@ MONGO_EXPORT gridfs_offset gridfile_read( gridfile *gfile, gridfs_offset size, c
     mongo_cursor *chunks;
     bson chunk;
 
-    int first_chunk;
-    int last_chunk;
-    int total_chunks;
+    size_t first_chunk;
+    size_t last_chunk;
+    size_t total_chunks;
     gridfs_offset chunksize;
     gridfs_offset contentlength;
     gridfs_offset bytes_left;

programming_language: C
filename: gridfs.h
change_type: ModificationType.MODIFY
diff: @@ -48,7 +48,7 @@ typedef struct {
     gridfs_offset length; /**> The length of this gridfile */
     int chunk_num;      /**> The number of the current chunk being written to */
     char *pending_data; /**> A buffer storing data still to be written to chunks */
-    int pending_len;    /**> Length of pending_data buffer */
+    size_t pending_len;    /**> Length of pending_data buffer */
 } gridfile;
 
 MONGO_EXPORT gridfs* gridfs_create( void );
@@ -293,7 +293,7 @@ MONGO_EXPORT void gridfile_get_chunk( gridfile *gfile, int n, bson* out );
  *
  *  @return - mongo_cursor of the chunks (must be destroyed after use)
  */
-MONGO_EXPORT mongo_cursor *gridfile_get_chunks( gridfile *gfile, int start, int size );
+MONGO_EXPORT mongo_cursor *gridfile_get_chunks( gridfile *gfile, int start, size_t size );
 
 /**
  *  Writes the GridFile to a stream

programming_language: C
filename: mongo.c
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,7 @@ MONGO_EXPORT const char*  mongo_get_server_err_string(mongo* conn) {
 
 MONGO_EXPORT void __mongo_set_error( mongo *conn, mongo_error_t err, const char *str,
                                      int errcode ) {
-    int errstr_size, str_size;
+    size_t errstr_size, str_size;
 
     conn->err = err;
     conn->errcode = errcode;
@@ -265,14 +265,14 @@ static void mongo_set_last_error( mongo *conn, bson_iterator *it, bson *obj ) {
 
 static const int ZERO = 0;
 static const int ONE = 1;
-static mongo_message *mongo_message_create( int len , int id , int responseTo , int op ) {
+static mongo_message *mongo_message_create( size_t len , int id , int responseTo , int op ) {
     mongo_message *mm = ( mongo_message * )bson_malloc( len );
 
     if ( !id )
         id = rand();
 
     /* native endian (converted on send) */
-    mm->head.len = len;
+    mm->head.len = ( int )len;
     mm->head.id = id;
     mm->head.responseTo = responseTo;
     mm->head.op = op;
@@ -344,7 +344,7 @@ static int mongo_read_response( mongo *conn, mongo_reply **reply ) {
 }
 
 
-static char *mongo_data_append( char *start , const void *data , int len ) {
+static char *mongo_data_append( char *start , const void *data , size_t len ) {
     memcpy( start , data , len );
     return start + len;
 }
@@ -900,8 +900,8 @@ MONGO_EXPORT int mongo_insert_batch( mongo *conn, const char *ns,
     mongo_write_concern *write_concern = NULL;
     int i;
     char *data;
-    int overhead =  16 + 4 + strlen( ns ) + 1;
-    int size = overhead;
+    size_t overhead =  16 + 4 + strlen( ns ) + 1;
+    size_t size = overhead;
 
     if( mongo_validate_ns( conn, ns ) != MONGO_OK )
         return MONGO_ERROR;
@@ -1204,7 +1204,7 @@ static int mongo_cursor_get_more( mongo_cursor *cursor ) {
     }
     else {
         char *data;
-        int sl = strlen( cursor->ns )+1;
+        size_t sl = strlen( cursor->ns )+1;
         int limit = 0;
         mongo_message *mm;
 
@@ -1516,7 +1516,7 @@ MONGO_EXPORT int mongo_run_command( mongo *conn, const char *db, const bson *com
     int ret = MONGO_OK;
     bson response = {NULL, 0};
     bson fields;
-    int sl = strlen( db );
+    size_t sl = strlen( db );
     char *ns = bson_malloc( sl + 5 + 1 ); /* ".$cmd" + nul */
     int res, success = 0;
 
@@ -1674,9 +1674,9 @@ static void mongo_pass_digest( const char *user, const char *pass, char hex_dige
     mongo_md5_byte_t digest[16];
 
     mongo_md5_init( &st );
-    mongo_md5_append( &st, ( const mongo_md5_byte_t * )user, strlen( user ) );
+    mongo_md5_append( &st, ( const mongo_md5_byte_t * )user, ( int )strlen( user ) );
     mongo_md5_append( &st, ( const mongo_md5_byte_t * )":mongo:", 7 );
-    mongo_md5_append( &st, ( const mongo_md5_byte_t * )pass, strlen( pass ) );
+    mongo_md5_append( &st, ( const mongo_md5_byte_t * )pass, ( int )strlen( pass ) );
     mongo_md5_finish( &st, digest );
     digest2hex( digest, hex_digest );
 }
@@ -1734,8 +1734,8 @@ MONGO_EXPORT bson_bool_t mongo_cmd_authenticate( mongo *conn, const char *db, co
     mongo_pass_digest( user, pass, hex_digest );
 
     mongo_md5_init( &st );
-    mongo_md5_append( &st, ( const mongo_md5_byte_t * )nonce, strlen( nonce ) );
-    mongo_md5_append( &st, ( const mongo_md5_byte_t * )user, strlen( user ) );
+    mongo_md5_append( &st, ( const mongo_md5_byte_t * )nonce, ( int )strlen( nonce ) );
+    mongo_md5_append( &st, ( const mongo_md5_byte_t * )user, ( int )strlen( user ) );
     mongo_md5_append( &st, ( const mongo_md5_byte_t * )hex_digest, 32 );
     mongo_md5_finish( &st, digest );
     digest2hex( digest, hex_digest );

programming_language: C