Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than

100 headers are read.  Adapted from patch by Jyrki Pulliainen.

diff --git a/Doc/library/http.client.rst b/Doc/library/http.client.rst
index 7423a4cd361a5ed1986b59641dfec03ff5a3db60..2f68df751c01ab5d572c12375fdf68da0277a505 100644 (file)
--- a/Doc/library/http.client.rst
+++ b/Doc/library/http.client.rst
@@ -169,8 +169,8 @@ The following exceptions are raised as appropriate:
    A subclass of :exc:`HTTPException`.  Raised if a server responds with a HTTP
    status code that we don't understand.
 
-The constants defined in this module are:
 
+The constants defined in this module are:
 
 .. data:: HTTP_PORT
 

diff --git a/Lib/http/client.py b/Lib/http/client.py
index 5466d0618d33c5c32bdcf09992a7e11594fcea50..f398a64a9f19cc8e23c06f97b02117246b6ea51a 100644 (file)
--- a/Lib/http/client.py
+++ b/Lib/http/client.py
@@ -206,6 +206,8 @@ MAXAMOUNT = 1048576
 
 # maximal line length when calling readline().
 _MAXLINE = 65536
+_MAXHEADERS = 100
+
 
 class HTTPMessage(email.message.Message):
     # XXX The only usage of this method is in
@@ -253,6 +255,8 @@ def parse_headers(fp, _class=HTTPMessage):
         if len(line) > _MAXLINE:
             raise LineTooLong("header line")
         headers.append(line)
+        if len(headers) > _MAXHEADERS:
+            raise HTTPException("got more than %d headers" % _MAXHEADERS)
         if line in (b'\r\n', b'\n', b''):
             break
     hstring = b''.join(headers).decode('iso-8859-1')

diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
index 420302c332c7011ba85c3d0606d20fcad6089492..226e79eccacb6c8924cd6d6c5debb8fac34b4970 100644 (file)
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -272,6 +272,15 @@ class BasicTest(TestCase):
         if resp.read():
             self.fail("Did not expect response from HEAD request")
 
+    def test_too_many_headers(self):
+        headers = '\r\n'.join('Header%d: foo' % i
+                              for i in range(client._MAXHEADERS + 1)) + '\r\n'
+        text = ('HTTP/1.1 200 OK\r\n' + headers)
+        s = FakeSocket(text)
+        r = client.HTTPResponse(s)
+        self.assertRaisesRegex(client.HTTPException,
+                               r"got more than \d+ headers", r.begin)
+
     def test_send_file(self):
         expected = (b'GET /foo HTTP/1.1\r\nHost: example.com\r\n'
                     b'Accept-Encoding: identity\r\nContent-Length:')

diff --git a/Misc/NEWS b/Misc/NEWS
index d239d696527f4c2bdcc0c5c24d19085280b68a7e..67afa1465173ea575be210a94b7d5bac0575d211 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -1,4 +1,4 @@
-++++++++++
++++++++++++
 Python News
 +++++++++++
 
@@ -10,6 +10,9 @@ What's New in Python 3.2.6?
 Library
 -------
 
+- Issue #16037: HTTPMessage.readheaders() raises an HTTPException when more than
+  100 headers are read.  Adapted from patch by Jyrki Pulliainen.
+
 - Issue #18709: Fix CVE-2013-4238. The SSL module now handles NULL bytes
   inside subjectAltName correctly. Formerly the module has used OpenSSL's
   GENERAL_NAME_print() function to get the string represention of ASN.1