Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-01-07 16:02:55 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.14] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-142216)

Browse source 
The CGI server on Windows could consume the amount of memory specified
in the Content-Length header of the request even if the client does not
send such much data. Now it reads the POST request body by chunks,
therefore the memory consumption is proportional to the amount of sent
data.
This commit is contained in:
Serhiy Storchaka 2025-12-05 16:20:23 +02:00 • committed by GitHub
parent f130b06da3
commit 0e4f4f1a46
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 60 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

39
Lib/test/test_httpservers.py
View file

@ -913,6 +913,20 @@ def test_path_without_leading_slash(self):
print("</pre>")
"""
cgi_file7 = """\
#!%s
import os
import sys
print("Content-type: text/plain")
print()
content_length = int(os.environ["CONTENT_LENGTH"])
body = sys.stdin.buffer.read(content_length)
print(f"{content_length} {len(body)}")
"""
@unittest.skipIf(hasattr(os, 'geteuid') and os.geteuid() == 0,
"This test can't be run reliably as root (issue #13308).")
@ -952,6 +966,8 @@ def setUp(self):
self.file3_path = None
self.file4_path = None
self.file5_path = None
self.file6_path = None
self.file7_path = None
# The shebang line should be pure ASCII: use symlink if possible.
# See issue #7668.
@ -1006,6 +1022,11 @@ def setUp(self):
file6.write(cgi_file6 % self.pythonexe)
os.chmod(self.file6_path, 0o777)
self.file7_path = os.path.join(self.cgi_dir, 'file7.py')
with open(self.file7_path, 'w', encoding='utf-8') as file7:
file7.write(cgi_file7 % self.pythonexe)
os.chmod(self.file7_path, 0o777)
os.chdir(self.parent_dir)
def tearDown(self):
@ -1028,6 +1049,8 @@ def tearDown(self):
os.remove(self.file5_path)
if self.file6_path:
os.remove(self.file6_path)
if self.file7_path:
os.remove(self.file7_path)
os.rmdir(self.cgi_child_dir)
os.rmdir(self.cgi_dir)
os.rmdir(self.cgi_dir_in_sub_dir)
@ -1100,6 +1123,22 @@ def test_post(self):
self.assertEqual(res.read(), b'1, python, 123456' + self.linesep)
def test_large_content_length(self):
for w in range(15, 25):
size = 1 << w
body = b'X' * size
headers = {'Content-Length' : str(size)}
res = self.request('/cgi-bin/file7.py', 'POST', body, headers)
self.assertEqual(res.read(), b'%d %d' % (size, size) + self.linesep)
def test_large_content_length_truncated(self):
with support.swap_attr(self.request_handler, 'timeout', 0.001):
for w in range(18, 65):
size = 1 << w
headers = {'Content-Length' : str(size)}
res = self.request('/cgi-bin/file1.py', 'POST', b'x', headers)
self.assertEqual(res.read(), b'Hello World' + self.linesep)
def test_invaliduri(self):
res = self.request('/cgi-bin/invalid')
res.read()