#1627: httplib now ignores negative Content-Length headers.

diff --git a/Lib/httplib.py b/Lib/httplib.py
index bb4b59e70116fb6df97590ed648d9ae8433e17f6..5696467bd1a58890137628b93d27817bf93bb75e 100644 (file)
--- a/Lib/httplib.py
+++ b/Lib/httplib.py
@@ -438,6 +438,9 @@ class HTTPResponse:
                 self.length = int(length)
             except ValueError:
                 self.length = None
+            else:
+                if self.length < 0:  # ignore nonsensical negative lengths
+                    self.length = None
         else:
             self.length = None
 

diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
index e9dd9d66c34fcb67b40e95ac31303d1d435e1a90..67719fd5e0023b7a6edf6ee8c7710777d2bd51ac 100644 (file)
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -184,6 +184,13 @@ class BasicTest(TestCase):
             finally:
                 resp.close()
 
+    def test_negative_content_length(self):
+        sock = FakeSocket('HTTP/1.1 200 OK\r\nContent-Length: -1\r\n\r\nHello\r\n')
+        resp = httplib.HTTPResponse(sock, method="GET")
+        resp.begin()
+        self.assertEquals(resp.read(), 'Hello\r\n')
+        resp.close()
+
 
 class OfflineTest(TestCase):
     def test_responses(self):

diff --git a/Misc/NEWS b/Misc/NEWS
index 9d9264e0e30df363fc780610709052d0438280bd..38b4730192c3988ca60fb984b459f049474dcdaf 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -441,6 +441,8 @@ Core and builtins
 Library
 -------
 
+- #1627: httplib now ignores negative Content-Length headers.
+
 - #900744: If an invalid chunked-encoding header is sent by a server,
   httplib will now raise IncompleteRead and close the connection instead
   of raising ValueError.