File bpo44022-fix-http-client-infinite-line-reading-... of Package python

Overview Repositories Revisions Requests Users Attributes Meta

File bpo44022-fix-http-client-infinite-line-reading-after-a-HTTP-100-Continue.patch of Package python (Revision 9146cbf73c6a66f65ce831ccc4c8e9ac)

Currently displaying revision 9146cbf73c6a66f65ce831ccc4c8e9ac , Show latest

--- a/Lib/httplib.py
+++ b/Lib/httplib.py
@@ -449,6 +449,7 @@ class HTTPResponse:
             if status != CONTINUE:
                 break
             # skip the header from the 100 response
+            header_count = 0
             while True:
                 skip = self.fp.readline(_MAXLINE + 1)
                 if len(skip) > _MAXLINE:
@@ -458,6 +459,10 @@ class HTTPResponse:
                     break
                 if self.debuglevel > 0:
                     print "header:", skip
+                # bpo-44022: Fix http client infinite line reading (DoS) after a http 100
+                header_count += 1
+                if header_count > _MAXHEADERS:
+                    raise HTTPException("got more than %d headers" % _MAXHEADERS)
 
         self.status = status
         self.reason = reason.strip()
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2021-05-05-17-37-04.bpo-44022.bS3XJ9.rst
@@ -0,0 +1,2 @@
+mod:`http.client` now avoids infinitely reading potential HTTP headers after a
+``100 Continue`` status response from the server.

Places

File bpo44022-fix-http-client-infinite-line-reading-after-a-HTTP-100-Continue.patch of Package python (Revision 9146cbf73c6a66f65ce831ccc4c8e9ac)

Places