Add remaining-buffer bound check in _array_of_documents_to_buffer

In `_cbson_array_of_documents_to_buffer`, the per-element embedded-document
length `value_length` (read from server-controlled raw-batch BSON bytes) was
checked only for a lower bound (`value_length < BSON_MIN_SIZE`) before being
passed to `pymongo_buffer_write(buffer, string + position, value_length)`,
which calls `memcpy` from the source buffer.  There was no upper-bound check
that `value_length` fits within the remaining array bytes, so a crafted reply
(firstBatch/nextBatch) with an oversized inner `value_length` causes an
out-of-bounds read from the heap.  The pure-Python twin `_get_object_size` in
`bson/__init__.py` already validates this invariant; the C fast-path dropped it.

This commit adds the missing guard immediately before the `pymongo_buffer_write`
call, mirroring the adjacent error-handling style and the existing lower-bound
block.  The loop already guarantees `position < size` and
`(size - position) >= BSON_MIN_SIZE` via the prior check, so the subtraction
`size - position` is safe (no uint32 underflow).

The bug is reachable from `Collection.find_raw_batches()` and
`aggregate_raw_batches()` when the driver connects to a malicious or
compromised server.  It belongs to the same bug class as CVE-2024-5629
(OOB read in the bson C extension, fixed in 4.6.3) but affects a different
function.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: AgentGymLeader

bson/_cbsonmodule.c

@@ -3238,6 +3238,15 @@ static PyObject* _cbson_array_of_documents_to_buffer(PyObject* self, PyObject* a
             goto fail;
          }
 
+        if (value_length > (uint32_t)(size - position)) {
+            PyObject* InvalidBSON = _error("InvalidBSON");
+            if (InvalidBSON) {
+                PyErr_SetString(InvalidBSON, "invalid array content");
+                Py_DECREF(InvalidBSON);
+            }
+            goto fail;
+        }
+
         if (pymongo_buffer_write(buffer, string + position, value_length) == 1) {
             goto fail;
         }