[Python-checkins] cpython (2.7): Issue #16037: Limit httplib's _read_status() function to work around broken

Tue Sep 25 13:29:55 CEST 2012

http://hg.python.org/cpython/rev/8a22a2804a66
changeset: 79159:8a22a2804a66
branch: 2.7
user: Christian Heimes <christian at cheimes.de>
date: Tue Sep 25 13:29:30 2012 +0200
summary:
 Issue #16037: Limit httplib's _read_status() function to work around broken
HTTP servers and reduce memory usage. It's actually a backport of a Python
3.2 fix. Thanks to Adrien Kunysz.
files:
 Lib/httplib.py | 4 +++-
 Misc/NEWS | 4 ++++
 2 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/Lib/httplib.py b/Lib/httplib.py
--- a/Lib/httplib.py
+++ b/Lib/httplib.py
@@ -362,7 +362,9 @@
 
 def _read_status(self):
 # Initialize with Simple-Response defaults
- line = self.fp.readline()
+ line = self.fp.readline(_MAXLINE + 1)
+ if len(line) > _MAXLINE:
+ raise LineTooLong("header line")
 if self.debuglevel > 0:
 print "reply:", repr(line)
 if not line:
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,10 @@
 Core and Builtins
 -----------------
 
+- Issue #16037: Limit httplib's _read_status() function to work around broken
+ HTTP servers and reduce memory usage. It's actually a backport of a Python
+ 3.2 fix. Thanks to Adrien Kunysz.
+
 - Issue #13992: The trashcan mechanism is now thread-safe. This eliminates
 sporadic crashes in multi-thread programs when several long deallocator
 chains ran concurrently and involved subclasses of built-in container
-- 
Repository URL: http://hg.python.org/cpython
