From bf3f8eb9602154c9434cd82e61d1b103c30615f0 Mon Sep 17 00:00:00 2001 From: Georg Brandl Date: Sun, 27 Oct 2013 07:34:48 +0100 Subject: Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than 100 headers are read. Adapted from patch by Jyrki Pulliainen. --- Doc/library/http.client.rst | 2 +- Lib/http/client.py | 4 ++++ Lib/test/test_httplib.py | 9 +++++++++ Misc/NEWS | 3 +++ 4 files changed, 17 insertions(+), 1 deletion(-) diff --git a/Doc/library/http.client.rst b/Doc/library/http.client.rst index 6931fc6..4daeeea 100644 --- a/Doc/library/http.client.rst +++ b/Doc/library/http.client.rst @@ -169,8 +169,8 @@ The following exceptions are raised as appropriate: A subclass of :exc:`HTTPException`. Raised if a server responds with a HTTP status code that we don't understand. -The constants defined in this module are: +The constants defined in this module are: .. data:: HTTP_PORT diff --git a/Lib/http/client.py b/Lib/http/client.py index b72cf08..cc452e2 100644 --- a/Lib/http/client.py +++ b/Lib/http/client.py @@ -214,6 +214,8 @@ MAXAMOUNT = 1048576 # maximal line length when calling readline(). _MAXLINE = 65536 +_MAXHEADERS = 100 + class HTTPMessage(email.message.Message): # XXX The only usage of this method is in @@ -261,6 +263,8 @@ def parse_headers(fp, _class=HTTPMessage): if len(line) > _MAXLINE: raise LineTooLong("header line") headers.append(line) + if len(headers) > _MAXHEADERS: + raise HTTPException("got more than %d headers" % _MAXHEADERS) if line in (b'\r\n', b'\n', b''): break hstring = b''.join(headers).decode('iso-8859-1') diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py index 769ab13..f3c27c2 100644 --- a/Lib/test/test_httplib.py +++ b/Lib/test/test_httplib.py @@ -345,6 +345,15 @@ class BasicTest(TestCase): self.fail("Did not expect response from HEAD request") self.assertEqual(bytes(b), b'\x00'*5) + def test_too_many_headers(self): + headers = '\r\n'.join('Header%d: foo' % i + for i in range(client._MAXHEADERS + 1)) + '\r\n' + text = ('HTTP/1.1 200 OK\r\n' + headers) + s = FakeSocket(text) + r = client.HTTPResponse(s) + self.assertRaisesRegex(client.HTTPException, + r"got more than \d+ headers", r.begin) + def test_send_file(self): expected = (b'GET /foo HTTP/1.1\r\nHost: example.com\r\n' b'Accept-Encoding: identity\r\nContent-Length:') diff --git a/Misc/NEWS b/Misc/NEWS index 24f1847..6d01b35 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -81,6 +81,9 @@ Core and Builtins Library ------- +- Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than + 100 headers are read. Adapted from patch by Jyrki Pulliainen. + - Issue #16040: CVE-2013-1752: nntplib: Limit maximum line lengths to 2048 to prevent readline() calls from consuming too much memory. Patch by Jyrki Pulliainen. -- cgit v0.12