summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGeorg Brandl <georg@python.org>2014-01-25 08:02:18 (GMT)
committerGeorg Brandl <georg@python.org>2014-01-25 08:02:18 (GMT)
commitc11435399e7af8317e5a51642ee665347da2b97f (patch)
tree45a63ff03df5fda7b9e3c697331165ea5b22bbc0
parentf580d5b6f7468abf768a2ee6360168ad92893457 (diff)
downloadcpython-c11435399e7af8317e5a51642ee665347da2b97f.zip
cpython-c11435399e7af8317e5a51642ee665347da2b97f.tar.gz
cpython-c11435399e7af8317e5a51642ee665347da2b97f.tar.bz2
#16042: CVE-2013-1752: smtplib fix for unlimited readline() from socket
-rwxr-xr-xLib/smtplib.py5
-rw-r--r--Lib/test/mock_socket.py9
-rw-r--r--Lib/test/test_smtplib.py30
-rw-r--r--Misc/NEWS3
4 files changed, 43 insertions, 4 deletions
diff --git a/Lib/smtplib.py b/Lib/smtplib.py
index 072b973..57f181b 100755
--- a/Lib/smtplib.py
+++ b/Lib/smtplib.py
@@ -62,6 +62,7 @@ SMTP_PORT = 25
SMTP_SSL_PORT = 465
CRLF = "\r\n"
bCRLF = b"\r\n"
+_MAXLINE = 8192 # more than 8 times larger than RFC 821, 4.5.3
OLDSTYLE_AUTH = re.compile(r"auth=(.*)", re.I)
@@ -364,7 +365,7 @@ class SMTP:
self.file = self.sock.makefile('rb')
while 1:
try:
- line = self.file.readline()
+ line = self.file.readline(_MAXLINE + 1)
except socket.error as e:
self.close()
raise SMTPServerDisconnected("Connection unexpectedly closed: "
@@ -374,6 +375,8 @@ class SMTP:
raise SMTPServerDisconnected("Connection unexpectedly closed")
if self.debuglevel > 0:
print('reply:', repr(line), file=stderr)
+ if len(line) > _MAXLINE:
+ raise SMTPResponseException(500, "Line too long.")
resp.append(line[4:].strip(b' \t\r\n'))
code = line[:3]
# Check that the error code is syntactically correct.
diff --git a/Lib/test/mock_socket.py b/Lib/test/mock_socket.py
index d09e78c..861bfb2 100644
--- a/Lib/test/mock_socket.py
+++ b/Lib/test/mock_socket.py
@@ -21,8 +21,13 @@ class MockFile:
"""
def __init__(self, lines):
self.lines = lines
- def readline(self):
- return self.lines.pop(0) + b'\r\n'
+ def readline(self, limit=-1):
+ result = self.lines.pop(0) + b'\r\n'
+ if limit >= 0:
+ # Re-insert the line, removing the \r\n we added.
+ self.lines.insert(0, result[limit:-2])
+ result = result[:limit]
+ return result
def close(self):
pass
diff --git a/Lib/test/test_smtplib.py b/Lib/test/test_smtplib.py
index 8d1dbbf..d798068 100644
--- a/Lib/test/test_smtplib.py
+++ b/Lib/test/test_smtplib.py
@@ -569,6 +569,33 @@ class BadHELOServerTests(unittest.TestCase):
HOST, self.port, 'localhost', 3)
+@unittest.skipUnless(threading, 'Threading required for this test.')
+class TooLongLineTests(unittest.TestCase):
+ respdata = b'250 OK' + (b'.' * smtplib._MAXLINE * 2) + b'\n'
+
+ def setUp(self):
+ self.old_stdout = sys.stdout
+ self.output = io.StringIO()
+ sys.stdout = self.output
+
+ self.evt = threading.Event()
+ self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ self.sock.settimeout(15)
+ self.port = support.bind_port(self.sock)
+ servargs = (self.evt, self.respdata, self.sock)
+ threading.Thread(target=server, args=servargs).start()
+ self.evt.wait()
+ self.evt.clear()
+
+ def tearDown(self):
+ self.evt.wait()
+ sys.stdout = self.old_stdout
+
+ def testLineTooLong(self):
+ self.assertRaises(smtplib.SMTPResponseException, smtplib.SMTP,
+ HOST, self.port, 'localhost', 3)
+
+
sim_users = {'Mr.A@somewhere.com':'John A',
'Ms.B@xn--fo-fka.com':'Sally B',
'Mrs.C@somewhereesle.com':'Ruth C',
@@ -885,7 +912,8 @@ class SMTPSimTests(unittest.TestCase):
def test_main(verbose=None):
support.run_unittest(GeneralTests, DebuggingServerTests,
NonConnectingTests,
- BadHELOServerTests, SMTPSimTests)
+ BadHELOServerTests, SMTPSimTests,
+ TooLongLineTests)
if __name__ == '__main__':
test_main()
diff --git a/Misc/NEWS b/Misc/NEWS
index 2de9b31..cac7561 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -50,6 +50,9 @@ Core and Builtins
Library
-------
+- Issue #16042: CVE-2013-1752: smtplib: Limit amount of data read by
+ limiting the call to readline(). Original patch by Christian Heimes.
+
- Issue #20317: ExitStack.__exit__ could create a self-referential loop if an
exception raised by a cleanup operation already had its context set
correctly (for example, by the @contextmanager decorator). The infinite