Harden BsonBinaryReader.skipValue() size validation

[rozza]

The skip path in doSkipValue() was more permissive than the canonical decode path, accepting malformed BSON sizes that full decoding rejects. This allowed RawBsonDocument metadata accessors (size(), containsKey(), get()) to accept attacker-controlled malformed data as valid fields.

Add type-specific validation helpers to doSkipValue():

• readStringSize(): rejects size 0 (STRING, SYMBOL, JAVASCRIPT, DB_POINTER)
• readContainerSize(min): rejects undersized containers (DOCUMENT, ARRAY, JAVASCRIPT_WITH_SCOPE) that would produce negative skips
• readJavaScriptWithScopeSize(): validates nested code/scope sizes and total-size consistency
• addTrailingBytes(): guards against int overflow for BINARY and DB_POINTER

BINARY size 0 remains valid (empty binary is spec-compliant).

JAVA-6220

[Copilot]

Pull request overview

This PR hardens BsonBinaryReader.skipValue() so its skip-path size handling more closely matches the canonical decode-path validation, preventing RawBsonDocument metadata accessors (size(), containsKey(), get()) from accepting certain malformed BSON payloads as valid (JAVA-6220).

Changes:

• Add type-specific size validation helpers in BsonBinaryReader.doSkipValue() (strings, containers, JavaScript-with-scope, overflow-safe trailing bytes).
• Add focused BsonBinaryReaderTest coverage for malformed sizes (zero-length strings/symbol/js/dbpointer, undersized containers, JS-with-scope consistency checks, overflow guards) and minimal-valid regressions.
• Add RawBsonDocumentTest regression tests demonstrating that metadata accessors reject malformed zero-length string values when iteration requires skipValue().

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
bson/src/main/org/bson/BsonBinaryReader.java	Tightens skip-path validation via helpers for string/container sizes, JS-with-scope consistency, and overflow-safe skip calculations.
bson/src/test/unit/org/bson/BsonBinaryReaderTest.java	Adds comprehensive unit tests exercising newly hardened skipValue() validation paths plus minimal-valid regressions.
bson/src/test/unit/org/bson/RawBsonDocumentTest.java	Adds regression tests ensuring RawBsonDocument metadata accessors reject malformed documents that require skipValue() iteration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.