From 67fe6bb0fbfc4fce04675502027761fc5718082f Mon Sep 17 00:00:00 2001
From: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Sun, 17 Nov 2019 03:05:30 +0000
Subject: [PATCH] MongoDB wire protocol is using signed int32. Fixes #1802
 Unlike the old bin library, Lua string.pack does not support silent
 conversions: Negative integers cannot be "I" packed and 0xFFFFFFFF cannot be
 packed with "i4"

---
 CHANGELOG          |  3 +++
 nselib/mongodb.lua | 20 ++++++++++----------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8eb8c9d5e7..2964337c4a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,9 @@ o [Windows] Add support for the new loopback behavior in Npcap 0.9983. This
   Adapter to be installed, which was a source of problems for some users.
   [Daniel Miller]
 
+o [NSE][GH1802] The MongoDB library was causing errors when assembling protocol
+  payloads. [nnposter]
+
 o [NSE][GH#1781][GH#1796] The RTSP library was not correctly generating request
   strings. [nnposter]
 
diff --git a/nselib/mongodb.lua b/nselib/mongodb.lua
index 56e746cde1..60438af09e 100644
--- a/nselib/mongodb.lua
+++ b/nselib/mongodb.lua
@@ -373,10 +373,10 @@ MongoData ={
     return o
   end
 }
---Adds unsigned int32 to the message body
+--Adds signed int32 to the message body
 --@param value the value to add
-function MongoData:addUnsignedInt32(value)
-  self.valueString = self.valueString..string.pack("<I4",value)
+function MongoData:addInt32(value)
+  self.valueString = self.valueString..string.pack("<i4",value)
 end
 -- Adds a string to the message body
 --@param value the string to add
@@ -402,10 +402,10 @@ end
 -- This method creates necessary header information and puts it with the body
 function MongoData:data()
   local header = MongoData:new()
-  header:addUnsignedInt32( self.valueString:len()+4+4+4+4)
-  header:addUnsignedInt32( self.requestID)
-  header:addUnsignedInt32( self.responseTo or 0xFFFFFFFF)
-  header:addUnsignedInt32( self.opCode)
+  header:addInt32( self.valueString:len()+4+4+4+4)
+  header:addInt32( self.requestID)
+  header:addInt32( self.responseTo or -1)
+  header:addInt32( self.opCode)
   return header.valueString .. self.valueString
 end
 -- Creates a query
@@ -415,10 +415,10 @@ end
 --@return packet data OR error message
 local function createQuery(collectionName, query)
   local packet = MongoData:new({opCode=MongoData.OP.QUERY})
-  packet:addUnsignedInt32(0); -- options
+  packet:addInt32(0); -- options
   packet:addString(collectionName);
-  packet:addUnsignedInt32(0) -- number to skip
-  packet:addUnsignedInt32(-1) -- number to return : no limit
+  packet:addInt32(0) -- number to skip
+  packet:addInt32(-1) -- number to return : no limit
   local status, error = packet:addBSON(query)
 
   if not status then