libmongocrypt-helper 1.20.3.0.1001 → 1.20.5.0.1001

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b7037c7cdeb5a2f1fe94446f583e7c953539328df98580028a07f46c296689ec
-  data.tar.gz: 52a6c553f0e7ee8e0c6aca713184fe9c13f7e5babf97c18e4eff17235b8e7109
+  metadata.gz: b483fc7b479e693858209265fa305b4bd51e34592b452bbbd36c32c13f262802
+  data.tar.gz: 352d1052b07f14081865b5c02fe8b33ce2b0a739550db43a6e57d6c26cd1a08b
 SHA512:
-  metadata.gz: 190dff33114c3f35a8ba07776144bdfde51523e75277176c4c0bf5bdef0be4d500500c3b11eed1520635e43d7b8201faec4faca54da7c99bd119da8d7c3f606e
-  data.tar.gz: 20446b82d1838e42ce90980bea22112b4af933cd66daa0984e15b00f1dde2867f408d87f5ed2f86ec146db64b4f0201c0a9be9cdcc30923e48acff5793ab1aa5
+  metadata.gz: 945910ccf2515b64cbd9dd1d97a9de2822562a2544533006e3aa5fa7837107697f6b38e5f43d0da1ce3218fa98d36362a9f883362d9e1efb16bb90fbee7d5236
+  data.tar.gz: ef89918bdf09d579c60cce8aa5ecdd779a655edffc7223fef5a97fc00fa63ef787c3d5b360ce880812dc3d96562c1ebda7ca158ba4968377e1fd95fcb9c9a81c

data/ext/libmongocrypt/libmongocrypt/CHANGELOG.md

@@ -1,5 +1,17 @@
 # ChangeLog
 
+## 1.20.5
+
+### Fixed
+- Fix possible abort parsing endpoints.
+- Reject more payloads that cannot be decrypted in explicit decryption.
+- Fix more degenerate cases of masterKey parsing.
+
+## 1.20.4
+
+### Fixed
+- Reject undersized decryption payloads.
+
 ## 1.20.3
 
 ### Fixed

data/ext/libmongocrypt/libmongocrypt/etc/cyclonedx.sbom.json

@@ -57,7 +57,7 @@
     }
   ],
   "metadata": {
-    "timestamp": "2026-08-07T17:48:10.053548+00:00",
+    "timestamp": "2026-09-03T12:34:15.836217+00:00",
     "tools": [
       {
         "externalReferences": [
@@ -100,7 +100,7 @@
       }
     ]
   },
-  "serialNumber": "urn:uuid:464d2591-6478-4559-a1c4-9a726248fc1e",
+  "serialNumber": "urn:uuid:f38989f9-86cb-4a6e-94b5-bbcbf0a8fc1f",
   "version": 1,
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-insert-update-payload-v2.c

@@ -523,7 +523,12 @@ const _mongocrypt_buffer_t *mc_FLE2InsertUpdatePayloadV2_decrypt(_mongocrypt_cry
         return NULL;
     }
 
-    _mongocrypt_buffer_resize(&iup->plaintext, fle2v2->get_plaintext_len(ciphertext.len, status));
+    const uint32_t plaintext_len = fle2v2->get_plaintext_len(ciphertext.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return NULL;
+    }
+
+    _mongocrypt_buffer_resize(&iup->plaintext, plaintext_len);
     uint32_t bytes_written;
 
     if (!fle2v2->do_decrypt(crypto, &iup->userKeyId, user_key, &ciphertext, &iup->plaintext, &bytes_written, status)) {

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-insert-update-payload.c

@@ -252,7 +252,12 @@ const _mongocrypt_buffer_t *mc_FLE2InsertUpdatePayload_decrypt(_mongocrypt_crypt
         return NULL;
     }
 
-    _mongocrypt_buffer_resize(&iup->plaintext, fle2aead->get_plaintext_len(ciphertext.len, status));
+    const uint32_t plaintext_len = fle2aead->get_plaintext_len(ciphertext.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return NULL;
+    }
+
+    _mongocrypt_buffer_resize(&iup->plaintext, plaintext_len);
     uint32_t bytes_written; /* ignored */
 
     if (!fle2aead

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-iev.c

@@ -353,7 +353,11 @@ static bool mc_FLE2IndexedEncryptedValue_decrypt(_mongocrypt_crypto_t *crypto,
     const _mongocrypt_buffer_t *token_buf = mc_ServerDataEncryptionLevel1Token_get(token);
     uint32_t bytes_written;
 
-    _mongocrypt_buffer_resize(&iev->Inner, fle2alg->get_plaintext_len(iev->InnerEncrypted.len, status));
+    const uint32_t inner_len = fle2alg->get_plaintext_len(iev->InnerEncrypted.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return false;
+    }
+    _mongocrypt_buffer_resize(&iev->Inner, inner_len);
 
     /* Decrypt InnerEncrypted. */
     if (!fle2alg->do_decrypt(crypto,
@@ -445,7 +449,11 @@ bool mc_FLE2IndexedEncryptedValue_add_K_Key(_mongocrypt_crypto_t *crypto,
         return false;
     }
     /* Attempt to decrypt ClientEncryptedValue */
-    _mongocrypt_buffer_resize(&iev->ClientValue, fle2aead->get_plaintext_len(iev->ClientEncryptedValue.len, status));
+    const uint32_t client_value_len = fle2aead->get_plaintext_len(iev->ClientEncryptedValue.len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return false;
+    }
+    _mongocrypt_buffer_resize(&iev->ClientValue, client_value_len);
     uint32_t bytes_written;
     if (!fle2aead->do_decrypt(crypto,
                               &iev->K_KeyId,

data/ext/libmongocrypt/libmongocrypt/src/mc-fle2-payload-uev-common.c

@@ -93,7 +93,7 @@ const _mongocrypt_buffer_t *_mc_FLE2UnindexedEncryptedValueCommon_decrypt(_mongo
     memcpy(AD.data + 1, key_uuid->data, key_uuid->len);
     AD.data[1 + key_uuid->len] = (uint8_t)original_bson_type;
     const uint32_t plaintext_len = fle2aead->get_plaintext_len(ciphertext->len, status);
-    if (plaintext_len == 0) {
+    if (!mongocrypt_status_ok(status)) {
         _mongocrypt_buffer_cleanup(&AD);
         return NULL;
     }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-crypto.c

@@ -443,9 +443,9 @@ static uint32_t _mongocrypt_calculate_plaintext_len(uint32_t inlen,
                                                     _mongocrypt_hmac_type_t hmac,
                                                     mongocrypt_status_t *status) {
     const uint32_t hmaclen = (hmac == HMAC_NONE) ? 0 : MONGOCRYPT_HMAC_LEN;
-    const uint32_t mincipher = (mode == MODE_CTR) ? 0 : MONGOCRYPT_BLOCK_SIZE;
+    const uint32_t mincipher = (mode == MODE_CTR) ? 1 : MONGOCRYPT_BLOCK_SIZE;
     if (inlen < (MONGOCRYPT_IV_LEN + mincipher + hmaclen)) {
-        CLIENT_ERR("input ciphertext too small. Must be at least %" PRIu32 " bytes",
+        CLIENT_ERR("input ciphertext too small. Must be more than %" PRIu32 " bytes",
                    MONGOCRYPT_IV_LEN + mincipher + hmaclen);
         return 0;
     }
@@ -1346,7 +1346,11 @@ bool _mongocrypt_unwrap_key(_mongocrypt_crypto_t *crypto,
 
     // _mongocrypt_wrap_key() uses FLE1 algorithm parameters.
     _mongocrypt_buffer_init(dek);
-    _mongocrypt_buffer_resize(dek, fle1alg->get_plaintext_len(encrypted_dek->len, status));
+    const uint32_t plaintext_len = fle1alg->get_plaintext_len(encrypted_dek->len, status);
+    if (!mongocrypt_status_ok(status)) {
+        return false;
+    }
+    _mongocrypt_buffer_resize(dek, plaintext_len);
 
     if (!fle1alg->do_decrypt(crypto, NULL /* associated data. */, kek, encrypted_dek, dek, &bytes_written, status)) {
         return false;

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-ctx-decrypt.c

@@ -344,7 +344,7 @@ static bool _replace_FLE1Payload_with_plaintext(void *ctx,
 
     const _mongocrypt_value_encryption_algorithm_t *fle1alg = _mcFLE1Algorithm();
     plaintext.len = fle1alg->get_plaintext_len(ciphertext.data.len, status);
-    CHECK_AND_RETURN(plaintext.len != 0);
+    CHECK_AND_RETURN(mongocrypt_status_ok(status));
     plaintext.data = bson_malloc0(plaintext.len);
     BSON_ASSERT(plaintext.data);
 
@@ -766,6 +766,25 @@ static void _cleanup(mongocrypt_ctx_t *ctx) {
     _mongocrypt_buffer_cleanup(&dctx->decrypted_doc);
 }
 
+/* Returns true if a subtype-6 payload's first byte names a recognized FLE blob
+ * subtype. */
+static bool _is_decryptable_fle_blob_subtype(uint8_t byte) {
+    switch (byte) {
+    case MC_SUBTYPE_FLE1DeterministicEncryptedValue:
+    case MC_SUBTYPE_FLE1RandomEncryptedValue:
+    case MC_SUBTYPE_FLE2InsertUpdatePayload:
+    case MC_SUBTYPE_FLE2UnindexedEncryptedValue:
+    case MC_SUBTYPE_FLE2IndexedEqualityEncryptedValue:
+    case MC_SUBTYPE_FLE2IndexedRangeEncryptedValue:
+    case MC_SUBTYPE_FLE2InsertUpdatePayloadV2:
+    case MC_SUBTYPE_FLE2IndexedEqualityEncryptedValueV2:
+    case MC_SUBTYPE_FLE2IndexedRangeEncryptedValueV2:
+    case MC_SUBTYPE_FLE2UnindexedEncryptedValueV2:
+    case MC_SUBTYPE_FLE2IndexedTextEncryptedValue: return true;
+    default: return false;
+    }
+}
+
 bool mongocrypt_ctx_explicit_decrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_binary_t *msg) {
     bson_iter_t iter;
     bson_t as_bson;
@@ -804,6 +823,14 @@ bool mongocrypt_ctx_explicit_decrypt_init(mongocrypt_ctx_t *ctx, mongocrypt_bina
             CLIENT_ERR("decryption expected BSON binary subtype %d, got %d", (int)BSON_SUBTYPE_ENCRYPTED, (int)subtype);
             return _mongocrypt_ctx_fail(ctx);
         }
+        if (binary_len == 0) {
+            CLIENT_ERR("unsupported FLE blob subtype: expected non-empty payload");
+            return _mongocrypt_ctx_fail(ctx);
+        }
+        if (!_is_decryptable_fle_blob_subtype(binary[0])) {
+            CLIENT_ERR("unsupported FLE blob subtype: %hhu", binary[0]);
+            return _mongocrypt_ctx_fail(ctx);
+        }
     }
 
     if (!mongocrypt_ctx_decrypt_init(ctx, msg)) {

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-endpoint.c

@@ -34,6 +34,104 @@ void _mongocrypt_endpoint_destroy(_mongocrypt_endpoint_t *endpoint) {
     bson_free(endpoint);
 }
 
+/* RFC 3986 section 2.3: unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" */
+static bool _is_unreserved(char c) {
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '-' || c == '.'
+        || c == '_' || c == '~';
+}
+
+/* RFC 3986 section 2.2: reserved = gen-delims / sub-delims */
+static bool _is_reserved(char c) {
+    return NULL
+        != strchr(":/?#[]@" /* gen-delims */
+                  "!$&'()*+,;=" /* sub-delims */,
+                  c);
+}
+
+static bool _is_hexdig(char c) {
+    return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F');
+}
+
+/* _endpoint_chars_are_valid returns true if `endpoint_raw` contains only characters permitted in a URI
+ * by RFC 3986. Useful to prevent malformed endpoints being used to construct HTTP requests. */
+static bool _endpoint_chars_are_valid(const char *endpoint_raw, mongocrypt_status_t *status) {
+    for (const char *c = endpoint_raw; *c != '\0'; c++) {
+        if (_is_unreserved(*c) || _is_reserved(*c)) {
+            continue;
+        }
+        if (*c == '%') {
+            /* Returns false if either character is the NUL terminator. */
+            if (!_is_hexdig(c[1])) {
+                CLIENT_ERR("Invalid percent-encoding in endpoint at offset %zu: 0x%02x",
+                           (size_t)(c - endpoint_raw) + 1,
+                           (unsigned char)c[1]);
+                return false;
+            }
+            if (!_is_hexdig(c[2])) {
+                CLIENT_ERR("Invalid percent-encoding in endpoint at offset %zu: 0x%02x",
+                           (size_t)(c - endpoint_raw) + 2,
+                           (unsigned char)c[2]);
+                return false;
+            }
+            c += 2;
+            continue;
+        }
+        CLIENT_ERR("Invalid character in endpoint at offset %zu: 0x%02x",
+                   (size_t)(c - endpoint_raw),
+                   (unsigned char)*c);
+        return false;
+    }
+    return true;
+}
+
+/* RFC 3986 section 2.2: sub-delims. Permitted in a reg-name; gen-delims are not. */
+static bool _is_sub_delim(char c) {
+    return NULL != strchr("!$&'()*+,;=", c);
+}
+
+/* _host_chars_are_valid returns true if `host` is an RFC 3986 section 3.2.2 `reg-name`:
+ *
+ *   reg-name = *( unreserved / pct-encoded / sub-delims )
+ *
+ * The gen-delims (":/?#[]@") are not permitted. The parse above already ends the host at ':', '/', and '?',
+ * so in practice this rejects '#', '@', and the brackets of an IP-literal.
+ *
+ * This is defense in depth. `host` reaches the Host header, where CR and LF are the only characters that can
+ * alter the message and kms-message rejects them, and `host_and_port` is passed to the consumer as the
+ * address to connect to, where a gen-delim yields a name that does not resolve rather than a structural
+ * problem. An `IP-literal` (RFC 3986 section 3.2.2) is not supported: the parse splits the host at the first
+ * colon with no bracket handling, so "[2001:db8::1]" yielded a host of "[2001" and a port of "db8::1]". */
+static bool _host_chars_are_valid(const char *host, mongocrypt_status_t *status) {
+    for (const char *c = host; *c != '\0'; c++) {
+        if (_is_unreserved(*c) || _is_sub_delim(*c)) {
+            continue;
+        }
+        if (*c == '%') {
+            /* Already validated by _endpoint_chars_are_valid. */
+            c += 2;
+            continue;
+        }
+        CLIENT_ERR("Invalid character in endpoint host: 0x%02x", (unsigned char)*c);
+        return false;
+    }
+    return true;
+}
+
+/* _port_chars_are_valid returns true if `port` is a non-empty run of digits. */
+static bool _port_chars_are_valid(const char *port, mongocrypt_status_t *status) {
+    if (*port == '\0') {
+        CLIENT_ERR("Invalid endpoint, expected a port after the colon");
+        return false;
+    }
+    for (const char *c = port; *c != '\0'; c++) {
+        if (*c < '0' || *c > '9') {
+            CLIENT_ERR("Invalid character in endpoint port: 0x%02x", (unsigned char)*c);
+            return false;
+        }
+    }
+    return true;
+}
+
 /* Parses a subset of URIs of the form:
  * [protocol://][host[:port]][path][?query]
  */
@@ -61,6 +159,11 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
         goto fail;
     }
 
+    /* Validate before parsing: every field parsed below is a substring of `original`. */
+    if (!_endpoint_chars_are_valid(endpoint->original, status)) {
+        goto fail;
+    }
+
     /* Parse optional protocol. */
     pos = strstr(endpoint->original, "://");
     if (pos) {
@@ -92,14 +195,15 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
     colon = strstr(pos, ":");
     qmark = strstr(pos, "?");
     slash = strstr(pos, "/");
-    if (colon) {
-        host_end = colon;
-    } else if (slash) {
+    /* The host ends at the first delimiter. A colon delimits a port only if it
+     * precedes the path and query: in "example.com/path:8080" the colon is part
+     * of the path, not a port separator. */
+    host_end = colon;
+    if (slash && (!host_end || slash < host_end)) {
         host_end = slash;
-    } else if (qmark) {
+    }
+    if (qmark && (!host_end || qmark < host_end)) {
         host_end = qmark;
-    } else {
-        host_end = NULL;
     }
 
     if (host_end) {
@@ -112,12 +216,16 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
         endpoint->host = bson_strdup(host_start);
     }
 
+    if (!_host_chars_are_valid(endpoint->host, status)) {
+        goto fail;
+    }
+
     /* Parse optional port */
-    if (colon) {
+    if (colon && colon == host_end) {
         prev = colon + 1;
-        qmark = strstr(pos, "?");
-        slash = strstr(pos, "/");
-        if (slash) {
+        qmark = strstr(prev, "?");
+        slash = strstr(prev, "/");
+        if (slash && (!qmark || slash < qmark)) {
             endpoint->port = bson_strndup(prev, (size_t)(slash - prev));
         } else if (qmark) {
             BSON_ASSERT(qmark >= prev);
@@ -125,6 +233,10 @@ _mongocrypt_endpoint_t *_mongocrypt_endpoint_new(const char *endpoint_raw,
         } else {
             endpoint->port = bson_strdup(prev);
         }
+
+        if (!_port_chars_are_valid(endpoint->port, status)) {
+            goto fail;
+        }
     }
 
     /* Parse optional path */

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-kek.c

@@ -171,18 +171,25 @@ bool _mongocrypt_kek_parse_owned(const bson_t *bson, _mongocrypt_kek_t *kek, mon
     BSON_ASSERT_PARAM(bson);
     BSON_ASSERT_PARAM(kek);
 
+    /* Parse into a scratch KEK and only commit to `kek` once the whole
+     * definition is valid. Writing the provider tag before the union payload is
+     * populated would leave `kek` in a state where the tag and the union
+     * disagree, which _mongocrypt_kek_cleanup would act on. */
+    _mongocrypt_kek_t parsed;
+    memset(&parsed, 0, sizeof(parsed));
+
     if (!_mongocrypt_parse_required_utf8(bson, "provider", &kms_provider, status)) {
         goto done;
     }
 
-    kek->kmsid = bson_strdup(kms_provider);
+    parsed.kmsid = bson_strdup(kms_provider);
 
     _mongocrypt_kms_provider_t type;
-    if (!mc_kmsid_parse(kek->kmsid, &type, &kek->kmsid_name, status)) {
+    if (!mc_kmsid_parse(parsed.kmsid, &type, &parsed.kmsid_name, status)) {
         goto done;
     }
 
-    kek->kms_provider = type;
+    parsed.kms_provider = type;
     switch (type) {
     default:
     case MONGOCRYPT_KMS_PROVIDER_NONE: {
@@ -190,7 +197,7 @@ bool _mongocrypt_kek_parse_owned(const bson_t *bson, _mongocrypt_kek_t *kek, mon
         goto done;
     }
     case MONGOCRYPT_KMS_PROVIDER_AWS: {
-        if (!_mongocrypt_aws_kek_parse(&kek->provider.aws, kek->kmsid, bson, status)) {
+        if (!_mongocrypt_aws_kek_parse(&parsed.provider.aws, parsed.kmsid, bson, status)) {
             goto done;
         }
         break;
@@ -202,27 +209,32 @@ bool _mongocrypt_kek_parse_owned(const bson_t *bson, _mongocrypt_kek_t *kek, mon
         break;
     }
     case MONGOCRYPT_KMS_PROVIDER_AZURE: {
-        if (!_mongocrypt_azure_kek_parse(&kek->provider.azure, kek->kmsid, bson, status)) {
+        if (!_mongocrypt_azure_kek_parse(&parsed.provider.azure, parsed.kmsid, bson, status)) {
             goto done;
         }
         break;
     }
     case MONGOCRYPT_KMS_PROVIDER_GCP: {
-        if (!_mongocrypt_gcp_kek_parse(&kek->provider.gcp, kek->kmsid, bson, status)) {
+        if (!_mongocrypt_gcp_kek_parse(&parsed.provider.gcp, parsed.kmsid, bson, status)) {
             goto done;
         }
         break;
     }
     case MONGOCRYPT_KMS_PROVIDER_KMIP: {
-        if (!_mongocrypt_kmip_kek_parse(&kek->provider.kmip, kek->kmsid, bson, status)) {
+        if (!_mongocrypt_kmip_kek_parse(&parsed.provider.kmip, parsed.kmsid, bson, status)) {
             goto done;
         }
         break;
     }
     }
 
+    /* Success: replace any prior contents of `kek` and take ownership. */
+    _mongocrypt_kek_cleanup(kek);
+    *kek = parsed;
+    memset(&parsed, 0, sizeof(parsed));
     ret = true;
 done:
+    _mongocrypt_kek_cleanup(&parsed);
     bson_free(kms_provider);
     return ret;
 }

data/ext/libmongocrypt/libmongocrypt/src/mongocrypt-key.c

@@ -181,6 +181,10 @@ bool _mongocrypt_key_parse_owned(const bson_t *bson, _mongocrypt_key_doc_t *out,
         }
 
         if (0 == strcmp("masterKey", field)) {
+            if (has_master_key) {
+                CLIENT_ERR("duplicate field 'masterKey' in key document");
+                return false;
+            }
             has_master_key = true;
             if (!_parse_masterkey(&iter, out, status)) {
                 return false;

data/ext/libmongocrypt/libmongocrypt/test/data/kek-tests.json

@@ -15,7 +15,7 @@
             "keyName": "example keyName", 
             "provider": "azure"
         }, 
-        "expect": "invalid endpoint"
+        "expect": "Invalid character in endpoint"
     }, 
     {
         "input": {
@@ -47,7 +47,7 @@
             "key": "example arn", 
             "provider": "aws"
         }, 
-        "expect": "invalid endpoint"
+        "expect": "Invalid character in endpoint"
     }, 
     {
         "input": {
@@ -79,7 +79,7 @@
             "keyRing": "example keyRing", 
             "keyName": "example keyName"
         }, 
-        "expect": "invalid endpoint"
+        "expect": "Invalid character in endpoint"
     }, 
     {
         "input": {

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-payload-iup-v2.c

@@ -289,10 +289,74 @@ static void _test_mc_FLE2InsertUpdatePayloadV2_parse_errors(_mongocrypt_tester_t
     }
 }
 
+/* Builds a minimal parseable FLE2InsertUpdatePayloadV2 with a 'v' of `vlen` bytes.
+ * 'v' is a 16 byte user key UUID followed by (vlen - 16) bytes of ciphertext. */
+static void _make_iup_v2_with_value_len(_mongocrypt_buffer_t *out, uint32_t vlen) {
+    BSON_ASSERT(vlen >= UUID_LEN);
+    uint8_t token[32] = {0};
+    uint8_t uuid[UUID_LEN];
+    uint8_t value[128];
+
+    memset(uuid, 0xAB, sizeof(uuid));
+    memset(value, 0x41, sizeof(value));
+    BSON_ASSERT(vlen <= sizeof(value));
+    memcpy(value, uuid, sizeof(uuid));
+
+    bson_t payload;
+    bson_init(&payload);
+    ASSERT(bson_append_binary(&payload, "d", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "s", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "p", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "u", -1, BSON_SUBTYPE_UUID, uuid, sizeof(uuid)));
+    ASSERT(bson_append_int32(&payload, "t", -1, (int32_t)BSON_TYPE_UTF8));
+    ASSERT(bson_append_binary(&payload, "v", -1, BSON_SUBTYPE_BINARY, value, vlen));
+    ASSERT(bson_append_binary(&payload, "e", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "l", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_int64(&payload, "k", -1, 0));
+
+    _mongocrypt_buffer_init_size(out, 1 + (uint32_t)payload.len);
+    out->data[0] = (uint8_t)MC_SUBTYPE_FLE2InsertUpdatePayloadV2;
+    memcpy(out->data + 1, bson_get_data(&payload), payload.len);
+    bson_destroy(&payload);
+}
+
+/* A 'v' short enough that the plaintext length would be zero must be rejected
+ * with an error, not crash. */
+static void _test_mc_FLE2InsertUpdatePayloadV2_decrypt_short_ciphertext(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    _mongocrypt_buffer_t user_key;
+    _mongocrypt_buffer_init_size(&user_key, MONGOCRYPT_KEY_LEN);
+    memset(user_key.data, 0xCD, user_key.len);
+
+    /* FLE2v2AEAD is CBC + HMAC-SHA256: ciphertext must be at least
+     * IV (16) + one block (16) + HMAC (32) bytes. */
+    const uint32_t vlens[] = {UUID_LEN, UUID_LEN + 1, UUID_LEN + 48, UUID_LEN + 63};
+    for (size_t i = 0; i < sizeof(vlens) / sizeof(vlens[0]); i++) {
+        _mongocrypt_buffer_t input;
+        _make_iup_v2_with_value_len(&input, vlens[i]);
+
+        mc_FLE2InsertUpdatePayloadV2_t iup;
+        mc_FLE2InsertUpdatePayloadV2_init(&iup);
+        mongocrypt_status_t *status = mongocrypt_status_new();
+        ASSERT_OK_STATUS(mc_FLE2InsertUpdatePayloadV2_parse(&iup, &input, status), status);
+
+        const _mongocrypt_buffer_t *got = mc_FLE2InsertUpdatePayloadV2_decrypt(crypt->crypto, &iup, &user_key, status);
+        ASSERT_FAILS_STATUS(got != NULL, status, "input ciphertext too small");
+
+        mc_FLE2InsertUpdatePayloadV2_cleanup(&iup);
+        mongocrypt_status_destroy(status);
+        _mongocrypt_buffer_cleanup(&input);
+    }
+
+    _mongocrypt_buffer_cleanup(&user_key);
+    mongocrypt_destroy(crypt);
+}
+
 void _mongocrypt_tester_install_fle2_payload_iup_v2(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_FLE2InsertUpdatePayloadV2_parse);
     INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_decrypt);
     INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_includes_crypto_params);
     INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_parses_crypto_params);
     INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_parse_errors);
+    INSTALL_TEST(_test_mc_FLE2InsertUpdatePayloadV2_decrypt_short_ciphertext);
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mc-fle2-payload-iup.c

@@ -182,8 +182,75 @@ static void test_FLE2InsertUpdatePayload_parse_errors(_mongocrypt_tester_t *test
     _mongocrypt_buffer_cleanup(&input_buf);
 }
 
+/* Builds a minimal parseable FLE2InsertUpdatePayload with a 'v' of `vlen` bytes.
+ * 'v' is a 16 byte user key UUID followed by (vlen - 16) bytes of ciphertext. */
+static void _make_iup_with_value_len(_mongocrypt_buffer_t *out, uint32_t vlen) {
+    BSON_ASSERT(vlen >= UUID_LEN);
+    uint8_t token[32] = {0};
+    uint8_t uuid[UUID_LEN];
+    uint8_t value[128];
+
+    memset(uuid, 0xAB, sizeof(uuid));
+    memset(value, 0x41, sizeof(value));
+    BSON_ASSERT(vlen <= sizeof(value));
+    memcpy(value, uuid, sizeof(uuid));
+
+    bson_t payload;
+    bson_init(&payload);
+    ASSERT(bson_append_binary(&payload, "d", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "s", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "c", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "p", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+    ASSERT(bson_append_binary(&payload, "u", -1, BSON_SUBTYPE_UUID, uuid, sizeof(uuid)));
+    ASSERT(bson_append_int32(&payload, "t", -1, (int32_t)BSON_TYPE_UTF8));
+    ASSERT(bson_append_binary(&payload, "v", -1, BSON_SUBTYPE_BINARY, value, vlen));
+    ASSERT(bson_append_binary(&payload, "e", -1, BSON_SUBTYPE_BINARY, token, sizeof(token)));
+
+    _mongocrypt_buffer_init_size(out, 1 + (uint32_t)payload.len);
+    out->data[0] = (uint8_t)MC_SUBTYPE_FLE2InsertUpdatePayload;
+    memcpy(out->data + 1, bson_get_data(&payload), payload.len);
+    bson_destroy(&payload);
+}
+
+/* A 'v' short enough that the plaintext length would be zero must be rejected
+ * with an error, not crash. */
+static void test_FLE2InsertUpdatePayload_decrypt_short_ciphertext(_mongocrypt_tester_t *tester) {
+    if (!_aes_ctr_is_supported_by_os) {
+        TEST_PRINTF("Common Crypto with no CTR support detected. Skipping.");
+        return;
+    }
+
+    mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+    _mongocrypt_buffer_t user_key;
+    _mongocrypt_buffer_init_size(&user_key, MONGOCRYPT_KEY_LEN);
+    memset(user_key.data, 0xCD, user_key.len);
+
+    /* FLE2AEAD is CTR + HMAC-SHA256: ciphertext must exceed IV (16) + HMAC (32). */
+    const uint32_t vlens[] = {UUID_LEN, UUID_LEN + 1, UUID_LEN + 47, UUID_LEN + 48};
+    for (size_t i = 0; i < sizeof(vlens) / sizeof(vlens[0]); i++) {
+        _mongocrypt_buffer_t input;
+        _make_iup_with_value_len(&input, vlens[i]);
+
+        mc_FLE2InsertUpdatePayload_t iup;
+        mc_FLE2InsertUpdatePayload_init(&iup);
+        mongocrypt_status_t *status = mongocrypt_status_new();
+        ASSERT_OK_STATUS(mc_FLE2InsertUpdatePayload_parse(&iup, &input, status), status);
+
+        const _mongocrypt_buffer_t *got = mc_FLE2InsertUpdatePayload_decrypt(crypt->crypto, &iup, &user_key, status);
+        ASSERT_FAILS_STATUS(got != NULL, status, "input ciphertext too small");
+
+        mc_FLE2InsertUpdatePayload_cleanup(&iup);
+        mongocrypt_status_destroy(status);
+        _mongocrypt_buffer_cleanup(&input);
+    }
+
+    _mongocrypt_buffer_cleanup(&user_key);
+    mongocrypt_destroy(crypt);
+}
+
 void _mongocrypt_tester_install_fle2_payload_iup(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(test_FLE2InsertUpdatePayload_parse);
     INSTALL_TEST(test_FLE2InsertUpdatePayload_decrypt);
     INSTALL_TEST(test_FLE2InsertUpdatePayload_parse_errors);
+    INSTALL_TEST(test_FLE2InsertUpdatePayload_decrypt_short_ciphertext);
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-ctx-decrypt.c

@@ -46,6 +46,38 @@ static void _test_explicit_decrypt_init(_mongocrypt_tester_t *tester) {
     mongocrypt_destroy(crypt);
 }
 
+/* Regression test for MONGOCRYPT-966 */
+static void _test_explicit_decrypt_unknown_subtype(_mongocrypt_tester_t *tester) {
+    mongocrypt_t *const crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
+
+    const struct {
+        const char *desc;
+        const char *base64;
+    } cases[] = {
+        {"unrecognized subtype 0x08", "CKq7zA=="},
+        {"FLE1EncryptionPlaceholder (0x00)", "AA=="},
+        {"FLE2EncryptionPlaceholder (0x03)", "Aw=="},
+        {"FLE2FindEqualityPayload (0x05)", "BQ=="},
+        {"FLE2FindRangePayload (0x0a)", "Cg=="},
+        {"FLE2FindTextPayload (0x12)", "Eg=="},
+        {"zero-length payload", ""},
+    };
+
+    for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
+        mongocrypt_binary_t *const msg =
+            TEST_BSON("{ 'v': { '$binary': { 'subType': '06', 'base64': '%s' } } }", cases[i].base64);
+
+        mongocrypt_ctx_t *const ctx = mongocrypt_ctx_new(crypt);
+
+        ASSERT_FAILS(mongocrypt_ctx_explicit_decrypt_init(ctx, msg), ctx, "unsupported FLE blob subtype");
+        BSON_ASSERT(mongocrypt_ctx_state(ctx) == MONGOCRYPT_CTX_ERROR);
+
+        mongocrypt_ctx_destroy(ctx);
+    }
+
+    mongocrypt_destroy(crypt);
+}
+
 /* Test individual ctx states. */
 static void _test_decrypt_init(_mongocrypt_tester_t *tester) {
     mongocrypt_t *crypt;
@@ -788,28 +820,21 @@ typedef struct {
     mongocrypt_binary_t *msg;
     mongocrypt_binary_t *keys_to_feed[3]; // NULL terminated list.
     mongocrypt_binary_t *expect;
-    bool expect_ignored;
+    bool expect_error;
 } ed_testcase;
 
 static void ed_testcase_run(ed_testcase *tc) {
     printf("  explicit decrypt test: %s ... begin\n", tc->desc);
     mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT);
     mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt);
-    ASSERT_OK(mongocrypt_ctx_explicit_decrypt_init(ctx, tc->msg), ctx);
 
-    if (tc->expect_ignored) {
-        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_READY);
-        {
-            mongocrypt_binary_t *got = mongocrypt_binary_new();
-            bool ret = mongocrypt_ctx_finalize(ctx, got);
-            ASSERT_OK(ret, ctx);
-            // Expect input is returned unchanged.
-            ASSERT_MONGOCRYPT_BINARY_EQUAL_BSON(tc->msg, got);
-            mongocrypt_binary_destroy(got);
-        }
+    if (tc->expect_error) {
+        ASSERT_FAILS(mongocrypt_ctx_explicit_decrypt_init(ctx, tc->msg), ctx, "unsupported FLE blob subtype");
+        ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_ERROR);
         goto cleanup;
     }
 
+    ASSERT_OK(mongocrypt_ctx_explicit_decrypt_init(ctx, tc->msg), ctx);
     ASSERT_STATE_EQUAL(mongocrypt_ctx_state(ctx), MONGOCRYPT_CTX_NEED_MONGO_KEYS);
     {
         for (size_t i = 0; i < sizeof(tc->keys_to_feed) / sizeof(tc->keys_to_feed[0]); i++) {
@@ -858,12 +883,12 @@ static void _test_explicit_decrypt(_mongocrypt_tester_t *tester) {
         ed_testcase_run(&tc);
     }
 
-    // FLE1EncryptionPlaceholder is ignored.
+    // FLE1EncryptionPlaceholder is recognized but not decryptable: explicit decryption must error.
     // Payload is returned by query analysis and consumed by libmongocrypt. Payload is not expected to be given to user.
     {
         ed_testcase tc = {.desc = "FLE1EncryptionPlaceholder",
                           .msg = TEST_FILE("./test/data/explicit-decrypt/FLE1EncryptionPlaceholder.json"),
-                          .expect_ignored = true};
+                          .expect_error = true};
         ed_testcase_run(&tc);
     }
 
@@ -878,12 +903,12 @@ static void _test_explicit_decrypt(_mongocrypt_tester_t *tester) {
         ed_testcase_run(&tc);
     }
 
-    // FLE2EncryptionPlaceholder is ignored.
+    // FLE2EncryptionPlaceholder is recognized but not decryptable: explicit decryption must error.
     // Payload is returned by query analysis and consumed by libmongocrypt. Payload is not expected to be given to user.
     {
         ed_testcase tc = {.desc = "FLE2EncryptionPlaceholder",
                           .msg = TEST_FILE("./test/data/explicit-decrypt/FLE2EncryptionPlaceholder.json"),
-                          .expect_ignored = true};
+                          .expect_error = true};
         ed_testcase_run(&tc);
     }
 
@@ -952,12 +977,12 @@ static void _test_explicit_decrypt(_mongocrypt_tester_t *tester) {
         ed_testcase_run(&tc);
     }
 
-    // FLE2FindEqualityPayload is ignored.
+    // FLE2FindEqualityPayload is recognized but not decryptable: explicit decryption must error.
     // Payload does not contain encrypted ciphertext (only lookup tokens).
     {
         ed_testcase tc = {.desc = "FLE2FindEqualityPayload",
                           .msg = TEST_FILE("./test/data/explicit-decrypt/FLE2FindEqualityPayload.json"),
-                          .expect_ignored = true};
+                          .expect_error = true};
         ed_testcase_run(&tc);
     }
 
@@ -1030,18 +1055,19 @@ static void _test_explicit_decrypt(_mongocrypt_tester_t *tester) {
         ed_testcase_run(&tc);
     }
 
-    // FLE2FindEqualityPayloadV2 is ignored.
+    // FLE2FindEqualityPayloadV2 is recognized but not decryptable: explicit decryption must error.
     // Payload does not contain encrypted ciphertext (only lookup tokens).
     {
         ed_testcase tc = {.desc = "FLE2FindEqualityPayloadV2",
                           .msg = TEST_FILE("./test/data/explicit-decrypt/FLE2FindEqualityPayloadV2.json"),
-                          .expect_ignored = true};
+                          .expect_error = true};
         ed_testcase_run(&tc);
     }
 }
 
 void _mongocrypt_tester_install_ctx_decrypt(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(_test_explicit_decrypt_init);
+    INSTALL_TEST(_test_explicit_decrypt_unknown_subtype);
     INSTALL_TEST(_test_decrypt_init);
     INSTALL_TEST(_test_decrypt_need_keys);
     INSTALL_TEST(_test_decrypt_ready);

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-endpoint.c

@@ -66,6 +66,176 @@ static void _test_mongocrypt_endpoint(_mongocrypt_tester_t *tester) {
     ASSERT_STATUS_CONTAINS(status, "Invalid endpoint, expected dot separator in host, but got: malformed");
     _mongocrypt_endpoint_destroy(endpoint);
 
+    /* Test a colon in the path does not parse as a port. */
+    endpoint = _mongocrypt_endpoint_new("vault.example.com/path:8080", -1, NULL /* opts */, status);
+    BSON_ASSERT(endpoint);
+    ASSERT_STREQUAL(endpoint->host, "vault.example.com");
+    ASSERT_STREQUAL(endpoint->domain, "example.com");
+    BSON_ASSERT(!endpoint->port);
+    ASSERT_STREQUAL(endpoint->path, "path:8080");
+    ASSERT_STREQUAL(endpoint->host_and_port, "vault.example.com");
+    BSON_ASSERT(mongocrypt_status_ok(status));
+    _mongocrypt_endpoint_destroy(endpoint);
+
+    /* Test a colon in the query does not parse as a port. */
+    endpoint = _mongocrypt_endpoint_new("vault.example.com?query=a:b", -1, NULL /* opts */, status);
+    BSON_ASSERT(endpoint);
+    ASSERT_STREQUAL(endpoint->host, "vault.example.com");
+    BSON_ASSERT(!endpoint->port);
+    ASSERT_STREQUAL(endpoint->query, "query=a:b");
+    BSON_ASSERT(mongocrypt_status_ok(status));
+    _mongocrypt_endpoint_destroy(endpoint);
+
+    /* Test a port followed by a query, with no path. */
+    endpoint = _mongocrypt_endpoint_new("vault.example.com:443?query=value", -1, NULL /* opts */, status);
+    BSON_ASSERT(endpoint);
+    ASSERT_STREQUAL(endpoint->host, "vault.example.com");
+    ASSERT_STREQUAL(endpoint->port, "443");
+    ASSERT_STREQUAL(endpoint->query, "query=value");
+    ASSERT_STREQUAL(endpoint->host_and_port, "vault.example.com:443");
+    BSON_ASSERT(mongocrypt_status_ok(status));
+    _mongocrypt_endpoint_destroy(endpoint);
+
+    /* An endpoint may contain only the characters RFC 3986 permits in a URI. This is defense in depth:
+     * each context an endpoint reaches is validated where it is used. */
+    const char *const invalid[] = {
+        "a\r\nX-Injected: injected.example.com",        /* forges a header */
+        "a\r\n\r\nGET /evil.example.com",               /* ends the header section */
+        "example.com\", \"sub\": \"victim@example.com", /* injects a JWT claim */
+        "example.com\\x.example.com",                   /* backslash */
+        "example .com",                                 /* space */
+        "example.com\x7f",                              /* DEL */
+        "exampl\xc3\xa9.com",                           /* non-ASCII */
+    };
+    for (size_t i = 0; i < sizeof(invalid) / sizeof(invalid[0]); i++) {
+        endpoint = _mongocrypt_endpoint_new(invalid[i], -1, NULL /* opts */, status);
+        BSON_ASSERT(!endpoint);
+        ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint");
+    }
+
+    /* The offending byte is reported by offset and hex value. The endpoint itself is not echoed: it is
+     * not yet validated here, and may contain a CR or LF that would forge a line in a consumer's log. */
+    endpoint = _mongocrypt_endpoint_new("example .com", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint at offset 7: 0x20");
+
+    endpoint = _mongocrypt_endpoint_new("a\r\nX-Injected: injected.example.com", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint at offset 1: 0x0d");
+
+    /* An IPv6 literal is rejected. The parse has no bracket handling, so such an endpoint was never
+     * usable. Without a dot it is rejected earlier still, for
+     * lacking a subdomain separator. */
+    memset(&opts, 0, sizeof(opts));
+    opts.allow_empty_subdomain = true;
+    endpoint = _mongocrypt_endpoint_new("[2001:db8::1]:443", -1, &opts, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint host");
+
+    /* One with an embedded dot reaches the host check without the option. */
+    endpoint = _mongocrypt_endpoint_new("[::ffff:192.0.2.1]", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint host");
+
+    /* An IPv4 literal is accepted, as before. */
+    endpoint = _mongocrypt_endpoint_new("192.0.2.1:443", -1, NULL /* opts */, status);
+    BSON_ASSERT(endpoint);
+    ASSERT_STREQUAL(endpoint->host, "192.0.2.1");
+    ASSERT_STREQUAL(endpoint->port, "443");
+    ASSERT_STREQUAL(endpoint->host_and_port, "192.0.2.1:443");
+    BSON_ASSERT(mongocrypt_status_ok(status));
+    _mongocrypt_endpoint_destroy(endpoint);
+
+    /* Percent-encoding must be well formed. */
+    endpoint = _mongocrypt_endpoint_new("example.com/%zz", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid percent-encoding in endpoint at offset 13: 0x7a");
+
+    /* A '%' at the end of the string: the second hex digit is the NUL terminator. */
+    endpoint = _mongocrypt_endpoint_new("example.com/%2", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid percent-encoding in endpoint at offset 14: 0x00");
+
+    endpoint = _mongocrypt_endpoint_new("example.com/a%2Fb", -1, NULL /* opts */, status);
+    BSON_ASSERT(endpoint);
+    ASSERT_STREQUAL(endpoint->path, "a%2Fb");
+    BSON_ASSERT(mongocrypt_status_ok(status));
+    _mongocrypt_endpoint_destroy(endpoint);
+
+    /* A host must be an RFC 3986 `reg-name`. The gen-delims are rejected; the parse already ends the host
+     * at ':', '/', and '?', so this covers '#', '@', and the brackets of an IP-literal. */
+    const char *const invalid_hosts[] = {
+        "vault.example.com@evil.example.com", /* userinfo separator */
+        "vault.example.com#frag",
+        "[2001:db8::1]",
+    };
+    memset(&opts, 0, sizeof(opts));
+    opts.allow_empty_subdomain = true;
+    for (size_t i = 0; i < sizeof(invalid_hosts) / sizeof(invalid_hosts[0]); i++) {
+        endpoint = _mongocrypt_endpoint_new(invalid_hosts[i], -1, &opts, status);
+        BSON_ASSERT(!endpoint);
+        ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint host");
+    }
+
+    endpoint = _mongocrypt_endpoint_new("vault.example.com@evil.example.com", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint host: 0x40");
+
+    /* The sub-delims are permitted in a reg-name, so they are permitted here. An '&' reaching the Azure
+     * OAuth request body is prevented by percent-encoding it into the scope, not by this check. */
+    const char *const valid_hosts[] = {
+        "vault.example.com&x",
+        "vault.example.com=x",
+        "vault.example.com;x",
+        "vault.example.com,x",
+        "vault.example.com~x",
+        "vault.example.com%41",
+    };
+    for (size_t i = 0; i < sizeof(valid_hosts) / sizeof(valid_hosts[0]); i++) {
+        endpoint = _mongocrypt_endpoint_new(valid_hosts[i], -1, NULL /* opts */, status);
+        BSON_ASSERT(endpoint);
+        ASSERT_STREQUAL(endpoint->host, valid_hosts[i]);
+        BSON_ASSERT(mongocrypt_status_ok(status));
+        _mongocrypt_endpoint_destroy(endpoint);
+    }
+
+    /* The host check does not apply to the path or query, which may contain reserved characters. */
+    endpoint = _mongocrypt_endpoint_new("vault.example.com/p&q?a=b&c=d", -1, NULL /* opts */, status);
+    BSON_ASSERT(endpoint);
+    ASSERT_STREQUAL(endpoint->host, "vault.example.com");
+    ASSERT_STREQUAL(endpoint->path, "p&q");
+    ASSERT_STREQUAL(endpoint->query, "a=b&c=d");
+    BSON_ASSERT(mongocrypt_status_ok(status));
+    _mongocrypt_endpoint_destroy(endpoint);
+
+    /* A port may contain only digits. The port is appended to host_and_port, which is used as the Host
+     * header and as the address to connect to. */
+    const char *const invalid_ports[] = {
+        "vault.example.com:44&3",
+        "vault.example.com:443x",
+        "vault.example.com:-1",
+        "vault.example.com:44.3",
+    };
+    for (size_t i = 0; i < sizeof(invalid_ports) / sizeof(invalid_ports[0]); i++) {
+        endpoint = _mongocrypt_endpoint_new(invalid_ports[i], -1, NULL /* opts */, status);
+        BSON_ASSERT(!endpoint);
+        ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint port");
+    }
+
+    /* The offset is relative to the start of the port. */
+    endpoint = _mongocrypt_endpoint_new("vault.example.com:44&3", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid character in endpoint port: 0x26");
+
+    /* A colon with no port is rejected. */
+    endpoint = _mongocrypt_endpoint_new("vault.example.com:", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid endpoint, expected a port after the colon");
+
+    endpoint = _mongocrypt_endpoint_new("vault.example.com:/path", -1, NULL /* opts */, status);
+    BSON_ASSERT(!endpoint);
+    ASSERT_STATUS_CONTAINS(status, "Invalid endpoint, expected a port after the colon");
+
     /* A host without a dot separator is valid if the "allow_empty_subdomain"
      * option is true. */
     memset(&opts, 0, sizeof(opts));

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-kek.c

@@ -96,6 +96,42 @@ static void test_mongocrypt_kek_parsing(_mongocrypt_tester_t *tester) {
     bson_destroy(&test_file);
 }
 
+/* A failed parse must leave the KEK exactly as it was. Committing the new
+ * provider tag before the provider-specific parse repopulates the union would
+ * leave the previous provider's pointers readable under the new tag, which
+ * _mongocrypt_kek_cleanup would then free as the wrong type. See
+ * MONGOCRYPT-964. */
+static void test_mongocrypt_kek_parse_failure_leaves_kek_intact(_mongocrypt_tester_t *tester) {
+    mongocrypt_status_t *const status = mongocrypt_status_new();
+    _mongocrypt_kek_t kek;
+
+    memset(&kek, 0, sizeof(_mongocrypt_kek_t));
+
+    ASSERT_OK_STATUS(_mongocrypt_kek_parse_owned(TMP_BSON("{'provider': 'gcp', 'projectId': 'project', "
+                                                          "'location': 'global', 'keyRing': 'ring', "
+                                                          "'keyName': 'name'}"),
+                                                 &kek,
+                                                 status),
+                     status);
+
+    /* An AWS definition missing the required 'region' aborts mid-parse, after
+     * the provider tag would have been switched. */
+    ASSERT_FAILS_STATUS(_mongocrypt_kek_parse_owned(TMP_BSON("{'provider': 'aws', 'key': 'cmk-string'}"), &kek, status),
+                        status,
+                        "expected UTF-8 region");
+
+    /* The KEK still describes the GCP key it was parsed from. */
+    ASSERT_CMPINT(kek.kms_provider, ==, MONGOCRYPT_KMS_PROVIDER_GCP);
+    ASSERT_STREQUAL(kek.kmsid, "gcp");
+    ASSERT_STREQUAL(kek.provider.gcp.key_ring, "ring");
+    ASSERT_STREQUAL(kek.provider.gcp.key_name, "name");
+
+    /* Cleanup frees the GCP fields, matching the tag. */
+    _mongocrypt_kek_cleanup(&kek);
+    mongocrypt_status_destroy(status);
+}
+
 void _mongocrypt_tester_install_kek(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(test_mongocrypt_kek_parsing);
+    INSTALL_TEST(test_mongocrypt_kek_parse_failure_leaves_kek_intact);
 }

data/ext/libmongocrypt/libmongocrypt/test/test-mongocrypt-key.c

@@ -182,6 +182,31 @@ static void test_mongocrypt_key_parsing(_mongocrypt_tester_t *tester) {
     bson_destroy(&key_bson);
 }
 
+/* Regression test for MONGOCRYPT-964. */
+static void test_mongocrypt_key_parsing_duplicate_master_key(_mongocrypt_tester_t *tester) {
+    bson_t key_bson = BSON_INITIALIZER;
+    mongocrypt_status_t *const status = mongocrypt_status_new();
+
+    /* Two identical masterKey fields. */
+    _recreate_and_reset(tester, &key_bson, status, "masterKey", NULL);
+    bson_concat(&key_bson, TMP_BSON("{'masterKey': { 'provider': 'local' }}"));
+    bson_concat(&key_bson, TMP_BSON("{'masterKey': { 'provider': 'local' }}"));
+    _parse_fails(&key_bson, status, "duplicate field 'masterKey'");
+
+    /* A GCP masterKey followed by an AWS masterKey missing 'region'. The
+     * aborted second parse leaves the GCP 'keyRing' string in the union slot
+     * shared with aws.endpoint, which cleanup then frees as an endpoint. */
+    _recreate_and_reset(tester, &key_bson, status, "masterKey", NULL);
+    bson_concat(&key_bson,
+                TMP_BSON("{'masterKey': { 'provider': 'gcp', 'projectId': 'project', 'location': "
+                         "'global', 'keyRing': 'ring', 'keyName': 'name' }}"));
+    bson_concat(&key_bson, TMP_BSON("{'masterKey': { 'provider': 'aws', 'key': 'cmk-string' }}"));
+    _parse_fails(&key_bson, status, "duplicate field 'masterKey'");
+
+    mongocrypt_status_destroy(status);
+    bson_destroy(&key_bson);
+}
+
 static void test_mongocrypt_key_alt_name_from_iter(_mongocrypt_tester_t *tester) {
     mongocrypt_status_t *status;
     bson_iter_t iter;
@@ -230,5 +255,6 @@ static void test_mongocrypt_key_alt_name_from_iter(_mongocrypt_tester_t *tester)
 
 void _mongocrypt_tester_install_key(_mongocrypt_tester_t *tester) {
     INSTALL_TEST(test_mongocrypt_key_parsing);
+    INSTALL_TEST(test_mongocrypt_key_parsing_duplicate_master_key);
     INSTALL_TEST(test_mongocrypt_key_alt_name_from_iter);
 }

data/lib/libmongocrypt_helper/version.rb

@@ -1,5 +1,5 @@
 module LibmongocryptHelper
-  VERSION = '1.20.3.0.1001'
+  VERSION = '1.20.5.0.1001'
 
-  LIBMONGOCRYPT_VERSION = '1.20.3'
+  LIBMONGOCRYPT_VERSION = '1.20.5'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: libmongocrypt-helper
 version: !ruby/object:Gem::Version
-  version: 1.20.3.0.1001
+  version: 1.20.5.0.1001
 platform: ruby
 authors:
 - The MongoDB Ruby Team
@@ -1250,7 +1250,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.19
+rubygems_version: 4.0.23
 specification_version: 4
 summary: libmongocrypt convenience package
 test_files: []