4f815b3251
missing in 2.7.6: python-2.7.6-imaplib.patch python-2.7.6-poplib.patch smtplib_maxline-2.7.patch - CVE-2013-1753 (bnc#856835) gzip decompression bomb in xmlrpc client: xmlrpc_gzip_27.patch OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=159
64 lines
2.2 KiB
Diff
64 lines
2.2 KiB
Diff
|
|
# HG changeset patch
|
|
# User Georg Brandl <georg@python.org>
|
|
# Date 1382855033 -3600
|
|
# Node ID 68029048c9c6833b71c3121e5178f7f57f21b565
|
|
# Parent 10d0edadbcddfd983c2c6c22d06c5a535197f8bf
|
|
Issue #16041: CVE-2013-1752: poplib: Limit maximum line lengths to 2048 to
|
|
prevent readline() calls from consuming too much memory. Patch by Jyrki
|
|
Pulliainen.
|
|
|
|
Index: Python-2.7.6/Lib/poplib.py
|
|
===================================================================
|
|
--- Python-2.7.6.orig/Lib/poplib.py 2013-11-10 08:36:40.000000000 +0100
|
|
+++ Python-2.7.6/Lib/poplib.py 2014-02-07 18:45:45.454259311 +0100
|
|
@@ -32,6 +32,12 @@
|
|
LF = '\n'
|
|
CRLF = CR+LF
|
|
|
|
+# maximal line length when calling readline(). This is to prevent
|
|
+# reading arbitrary lenght lines. RFC 1939 limits POP3 line length to
|
|
+# 512 characters, including CRLF. We have selected 2048 just to be on
|
|
+# the safe side.
|
|
+_MAXLINE = 2048
|
|
+
|
|
|
|
class POP3:
|
|
|
|
@@ -103,7 +109,10 @@
|
|
# Raise error_proto('-ERR EOF') if the connection is closed.
|
|
|
|
def _getline(self):
|
|
- line = self.file.readline()
|
|
+ line = self.file.readline(_MAXLINE + 1)
|
|
+ if len(line) > _MAXLINE:
|
|
+ raise error_proto('line too long')
|
|
+
|
|
if self._debugging > 1: print '*get*', repr(line)
|
|
if not line: raise error_proto('-ERR EOF')
|
|
octets = len(line)
|
|
Index: Python-2.7.6/Lib/test/test_poplib.py
|
|
===================================================================
|
|
--- Python-2.7.6.orig/Lib/test/test_poplib.py 2013-11-10 08:36:40.000000000 +0100
|
|
+++ Python-2.7.6/Lib/test/test_poplib.py 2014-02-07 18:44:24.419856656 +0100
|
|
@@ -81,7 +81,7 @@
|
|
|
|
def cmd_list(self, arg):
|
|
if arg:
|
|
- self.push('+OK %s %s' %(arg, arg))
|
|
+ self.push('+OK %s %s' % (arg, arg))
|
|
else:
|
|
self.push('+OK')
|
|
asynchat.async_chat.push(self, LIST_RESP)
|
|
@@ -198,6 +198,10 @@
|
|
113)
|
|
self.assertEqual(self.client.retr('foo'), expected)
|
|
|
|
+ def test_too_long_lines(self):
|
|
+ self.assertRaises(poplib.error_proto, self.client._shortcmd,
|
|
+ 'echo +%s' % ((poplib._MAXLINE + 10) * 'a'))
|
|
+
|
|
def test_dele(self):
|
|
self.assertOK(self.client.dele('foo'))
|
|
|