diff options
| author | Georg Brandl <georg@python.org> | 2013-10-27 05:52:14 (GMT) |
|---|---|---|
| committer | Georg Brandl <georg@python.org> | 2013-10-27 05:52:14 (GMT) |
| commit | ca580f4ec1b08f492cbc8673e316f5cadf47aec2 (patch) | |
| tree | f008e13828169e119f8a940c3678d793c3bd11cf /Lib/imaplib.py | |
| parent | 246eb1105842c746a80865cd492502ad413949c2 (diff) | |
| download | cpython-ca580f4ec1b08f492cbc8673e316f5cadf47aec2.zip cpython-ca580f4ec1b08f492cbc8673e316f5cadf47aec2.tar.gz cpython-ca580f4ec1b08f492cbc8673e316f5cadf47aec2.tar.bz2 | |
Issue #16039: CVE-2013-1752: Change use of readline in imaplib module to limit
line length. Patch by Emil Lind.
Diffstat (limited to 'Lib/imaplib.py')
| -rw-r--r-- | Lib/imaplib.py | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/Lib/imaplib.py b/Lib/imaplib.py index 724f9d1..3f6656a 100644 --- a/Lib/imaplib.py +++ b/Lib/imaplib.py @@ -43,6 +43,15 @@ IMAP4_PORT = 143 IMAP4_SSL_PORT = 993 AllowedVersions = ('IMAP4REV1', 'IMAP4') # Most recent first +# Maximal line length when calling readline(). This is to prevent +# reading arbitrary length lines. RFC 3501 and 2060 (IMAP 4rev1) +# don't specify a line length. RFC 2683 however suggests limiting client +# command lines to 1000 octets and server command lines to 8000 octets. +# We have selected 10000 for some extra margin and since that is supposedly +# also what UW and Panda IMAP does. +_MAXLINE = 10000 + + # Commands Commands = { @@ -256,7 +265,10 @@ class IMAP4: def readline(self): """Read line from remote.""" - return self.file.readline() + line = self.file.readline(_MAXLINE + 1) + if len(line) > _MAXLINE: + raise self.error("got more than %d bytes" % _MAXLINE) + return line def send(self, data): |