bson before 0.8 incorrectly uses int rather than size_t for many variables parameters and return values. In particular the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.