[Chris McDonough, on 7/28/06] > From the initial bugreport > (http://sourceforge.net/tracker/index.php? > func=detail&aid=1112549&group_id=5470&atid=105470) > > """ > Various parts of cgi.FieldStorage call its > "read_lines_to_outerboundary", "read_lines" and > "skip_lines" methods. These methods use the > "readline" method of the file object that represents an > input stream. The input stream is typically data > supplied by an untrusted source (such as a user > uploading a file from a web browser). The input data > is not required by the RFC 822/1521/1522/1867 > specifications to contain any newline characters. For > example, it is within the bounds of the specification > to supply a a multipart/form-data input stream with a > "file-data" part that consists of a 2GB string composed > entirely of "x" characters (which happens to be > something I did that led me to noticing this bug). > """ > > This bug has been around for about a year but I just worked up a > patch yesterday that applies OK against current SVN. It's attached > to the issue. Would someone be so kind as to check it in? Guido has > already reviewed it, I believe.
Are either of our 2.5 release managers/coordinators on the internal Python security mailing list? I am, but only the list admin can see who's on that list. Since this bug is thought to be a security hole (the "DOS" in the subject line doesn't refer to your favorite operating system -- it's the Denial-Of-Service flavor of DOS), it's important that someone with sufficient power stare at this one and Pronounce on its fate for 2.5c1. Here's a clicky thing: http://www.python.org/sf/1112549 _______________________________________________ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/listinfo/python-dev Unsubscribe: http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com