4f815b3251
missing in 2.7.6: python-2.7.6-imaplib.patch python-2.7.6-poplib.patch smtplib_maxline-2.7.patch - CVE-2013-1753 (bnc#856835) gzip decompression bomb in xmlrpc client: xmlrpc_gzip_27.patch OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python?expand=0&rev=159
93 lines
3.3 KiB
Diff
93 lines
3.3 KiB
Diff
diff -r 44ac81e6d584 Lib/smtplib.py
|
|
--- a/Lib/smtplib.py Sun Oct 20 16:57:07 2013 +0300
|
|
+++ b/Lib/smtplib.py Sun Oct 20 17:44:15 2013 +0300
|
|
@@ -57,6 +57,7 @@
|
|
SMTP_PORT = 25
|
|
SMTP_SSL_PORT = 465
|
|
CRLF = "\r\n"
|
|
+_MAXLINE = 8192 # more than 8 times larger than RFC 821, 4.5.3
|
|
|
|
OLDSTYLE_AUTH = re.compile(r"auth=(.*)", re.I)
|
|
|
|
@@ -179,10 +180,14 @@
|
|
def __init__(self, sslobj):
|
|
self.sslobj = sslobj
|
|
|
|
- def readline(self):
|
|
+ def readline(self, size=-1):
|
|
+ if size < 0:
|
|
+ size = None
|
|
str = ""
|
|
chr = None
|
|
while chr != "\n":
|
|
+ if size is not None and len(str) >= size:
|
|
+ break
|
|
chr = self.sslobj.read(1)
|
|
if not chr:
|
|
break
|
|
@@ -353,7 +358,7 @@
|
|
self.file = self.sock.makefile('rb')
|
|
while 1:
|
|
try:
|
|
- line = self.file.readline()
|
|
+ line = self.file.readline(_MAXLINE + 1)
|
|
except socket.error as e:
|
|
self.close()
|
|
raise SMTPServerDisconnected("Connection unexpectedly closed: "
|
|
@@ -363,6 +368,8 @@
|
|
raise SMTPServerDisconnected("Connection unexpectedly closed")
|
|
if self.debuglevel > 0:
|
|
print>>stderr, 'reply:', repr(line)
|
|
+ if len(line) > _MAXLINE:
|
|
+ raise SMTPResponseException(500, "Line too long.")
|
|
resp.append(line[4:].strip())
|
|
code = line[:3]
|
|
# Check that the error code is syntactically correct.
|
|
diff -r 44ac81e6d584 Lib/test/test_smtplib.py
|
|
--- a/Lib/test/test_smtplib.py Sun Oct 20 16:57:07 2013 +0300
|
|
+++ b/Lib/test/test_smtplib.py Sun Oct 20 17:44:15 2013 +0300
|
|
@@ -292,6 +292,33 @@
|
|
HOST, self.port, 'localhost', 3)
|
|
|
|
|
|
+@unittest.skipUnless(threading, 'Threading required for this test.')
|
|
+class TooLongLineTests(unittest.TestCase):
|
|
+ respdata = '250 OK' + ('.' * smtplib._MAXLINE * 2) + '\n'
|
|
+
|
|
+ def setUp(self):
|
|
+ self.old_stdout = sys.stdout
|
|
+ self.output = StringIO.StringIO()
|
|
+ sys.stdout = self.output
|
|
+
|
|
+ self.evt = threading.Event()
|
|
+ self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
+ self.sock.settimeout(15)
|
|
+ self.port = test_support.bind_port(self.sock)
|
|
+ servargs = (self.evt, self.respdata, self.sock)
|
|
+ threading.Thread(target=server, args=servargs).start()
|
|
+ self.evt.wait()
|
|
+ self.evt.clear()
|
|
+
|
|
+ def tearDown(self):
|
|
+ self.evt.wait()
|
|
+ sys.stdout = self.old_stdout
|
|
+
|
|
+ def testLineTooLong(self):
|
|
+ self.assertRaises(smtplib.SMTPResponseException, smtplib.SMTP,
|
|
+ HOST, self.port, 'localhost', 3)
|
|
+
|
|
+
|
|
sim_users = {'Mr.A@somewhere.com':'John A',
|
|
'Ms.B@somewhere.com':'Sally B',
|
|
'Mrs.C@somewhereesle.com':'Ruth C',
|
|
@@ -511,7 +538,8 @@
|
|
def test_main(verbose=None):
|
|
test_support.run_unittest(GeneralTests, DebuggingServerTests,
|
|
NonConnectingTests,
|
|
- BadHELOServerTests, SMTPSimTests)
|
|
+ BadHELOServerTests, SMTPSimTests,
|
|
+ TooLongLineTests)
|
|
|
|
if __name__ == '__main__':
|
|
test_main()
|