diff options
| author | Georg Brandl <georg@python.org> | 2014-09-30 12:18:02 (GMT) |
|---|---|---|
| committer | Georg Brandl <georg@python.org> | 2014-09-30 12:18:02 (GMT) |
| commit | 210ee47e3340d8e689d8cce584e7c918d368f16b (patch) | |
| tree | 526fb45a80d57de0b30729fab1a97802caa36ac3 /Lib/smtplib.py | |
| parent | 70088f14ad33e9f6e1734513594f83d42880e885 (diff) | |
| download | cpython-210ee47e3340d8e689d8cce584e7c918d368f16b.zip cpython-210ee47e3340d8e689d8cce584e7c918d368f16b.tar.gz cpython-210ee47e3340d8e689d8cce584e7c918d368f16b.tar.bz2 | |
Issue #16042: CVE-2013-1752: smtplib: Limit amount of data read by
limiting the call to readline(). Original patch by Christian Heimes.
Diffstat (limited to 'Lib/smtplib.py')
| -rw-r--r-- | Lib/smtplib.py | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/Lib/smtplib.py b/Lib/smtplib.py index 679e478..b03533e 100644 --- a/Lib/smtplib.py +++ b/Lib/smtplib.py @@ -62,6 +62,7 @@ SMTP_PORT = 25 SMTP_SSL_PORT = 465 CRLF = "\r\n" bCRLF = b"\r\n" +_MAXLINE = 8192 # more than 8 times larger than RFC 821, 4.5.3 OLDSTYLE_AUTH = re.compile(r"auth=(.*)", re.I) @@ -363,7 +364,7 @@ class SMTP: self.file = self.sock.makefile('rb') while 1: try: - line = self.file.readline() + line = self.file.readline(_MAXLINE + 1) except socket.error as e: self.close() raise SMTPServerDisconnected("Connection unexpectedly closed: " @@ -373,6 +374,8 @@ class SMTP: raise SMTPServerDisconnected("Connection unexpectedly closed") if self.debuglevel > 0: print('reply:', repr(line), file=stderr) + if len(line) > _MAXLINE: + raise SMTPResponseException(500, "Line too long.") resp.append(line[4:].strip(b' \t\r\n')) code = line[:3] # Check that the error code is syntactically correct. |