Skip to content

Commit e53f243

Browse files
committed
bpo-44022: Fix httplib client deny of service with total header size check after 100
1 parent 96d5c70 commit e53f243

File tree

2 files changed

+12
-1
lines changed

2 files changed

+12
-1
lines changed

Lib/http/client.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -309,9 +309,12 @@ def begin(self):
309309
if status != CONTINUE:
310310
break
311311
# skip the header from the 100 response
312+
header_total_size = 0
312313
while True:
313314
skip = self.fp.readline(_MAXLINE + 1)
314-
if len(skip) > _MAXLINE:
315+
line_length = len(skip)
316+
header_total_size += line_length
317+
if line_length > _MAXLINE or header_total_size > _MAXLINE:
315318
raise LineTooLong("header line")
316319
skip = skip.strip()
317320
if not skip:

Lib/test/test_httplib.py

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1180,6 +1180,14 @@ def test_overflowing_header_line(self):
11801180
resp = client.HTTPResponse(FakeSocket(body))
11811181
self.assertRaises(client.LineTooLong, resp.begin)
11821182

1183+
def test_overflowing_total_header_size_after_100(self):
1184+
body = (
1185+
'HTTP/1.1 100 OK\r\n'
1186+
'r\n' * 32768
1187+
)
1188+
resp = client.HTTPResponse(FakeSocket(body))
1189+
self.assertRaises(client.LineTooLong, resp.begin)
1190+
11831191
def test_overflowing_chunked_line(self):
11841192
body = (
11851193
'HTTP/1.1 200 OK\r\n'

0 commit comments

Comments
 (0)