SERVER-30720 Integer overflow in SharedBuffer::grow_reallocate

Move the length check before the while loop.

(cherry picked from commit 5bdeccdef411b3c8e19c19b2e5190119889eba61)

1 files changed, 6 insertions, 5 deletions

diff --git a/src/mongo/bson/util/builder.h b/src/mongo/bson/util/builder.h
index b959c59236e..ba6945e3fbc 100644
--- a/src/mongo/bson/util/builder.h
+++ b/src/mongo/bson/util/builder.h
@@ -320,15 +320,16 @@ private:
     }
     /* "slow" portion of 'grow()'  */
     void NOINLINE_DECL grow_reallocate(int minSize) {
+        if (minSize > BufferMaxSize) {
+            std::stringstream ss;
+            ss << "BufBuilder attempted to grow() to " << minSize << " bytes, past the 64MB limit.";
+            msgasserted(13548, ss.str().c_str());
+        }
+
         int a = 64;
         while (a < minSize)
             a = a * 2;
 
-        if (a > BufferMaxSize) {
-            std::stringstream ss;
-            ss << "BufBuilder attempted to grow() to " << a << " bytes, past the 64MB limit.";
-            msgasserted(13548, ss.str().c_str());
-        }
         _buf.realloc(a);
         size = a;
     }