Issue #16038: CVE-2013-1752: ftplib: Limit amount of data read by
limiting the call to readline(). Original patch by Michał
Jastrzębski and Giampaolo Rodola.
diff --git a/Lib/ftplib.py b/Lib/ftplib.py
index 741e647..5e75e6d 100644
--- a/Lib/ftplib.py
+++ b/Lib/ftplib.py
@@ -49,6 +49,8 @@
# The standard FTP server control port
FTP_PORT = 21
+# The sizehint parameter passed to readline() calls
+MAXLINE = 8192
# Exception raised when an error or invalid response is received
@@ -96,6 +98,7 @@
debugging = 0
host = ''
port = FTP_PORT
+ maxline = MAXLINE
sock = None
file = None
welcome = None
@@ -194,7 +197,9 @@
# Internal: return one line from the server, stripping CRLF.
# Raise EOFError if the connection is closed
def getline(self):
- line = self.file.readline()
+ line = self.file.readline(self.maxline + 1)
+ if len(line) > self.maxline:
+ raise Error("got more than %d bytes" % self.maxline)
if self.debugging > 1:
print('*get*', self.sanitize(line))
if not line: raise EOFError
@@ -446,7 +451,9 @@
with self.transfercmd(cmd) as conn, \
conn.makefile('r', encoding=self.encoding) as fp:
while 1:
- line = fp.readline()
+ line = fp.readline(self.maxline + 1)
+ if len(line) > self.maxline:
+ raise Error("got more than %d bytes" % self.maxline)
if self.debugging > 2: print('*retr*', repr(line))
if not line:
break
@@ -496,7 +503,9 @@
self.voidcmd('TYPE A')
with self.transfercmd(cmd) as conn:
while 1:
- buf = fp.readline()
+ buf = fp.readline(self.maxline + 1)
+ if len(buf) > self.maxline:
+ raise Error("got more than %d bytes" % self.maxline)
if not buf: break
if buf[-2:] != B_CRLF:
if buf[-1] in B_CRLF: buf = buf[:-1]
@@ -773,7 +782,9 @@
fp = conn.makefile('r', encoding=self.encoding)
with fp, conn:
while 1:
- line = fp.readline()
+ line = fp.readline(self.maxline + 1)
+ if len(line) > self.maxline:
+ raise Error("got more than %d bytes" % self.maxline)
if self.debugging > 2: print('*retr*', repr(line))
if not line:
break
@@ -804,7 +815,9 @@
self.voidcmd('TYPE A')
with self.transfercmd(cmd) as conn:
while 1:
- buf = fp.readline()
+ buf = fp.readline(self.maxline + 1)
+ if len(buf) > self.maxline:
+ raise Error("got more than %d bytes" % self.maxline)
if not buf: break
if buf[-2:] != B_CRLF:
if buf[-1] in B_CRLF: buf = buf[:-1]
diff --git a/Lib/test/test_ftplib.py b/Lib/test/test_ftplib.py
index 2c45af3..4686183 100644
--- a/Lib/test/test_ftplib.py
+++ b/Lib/test/test_ftplib.py
@@ -91,6 +91,7 @@
self.next_response = ''
self.next_data = None
self.rest = None
+ self.next_retr_data = RETR_DATA
self.push('220 welcome')
def collect_incoming_data(self, data):
@@ -220,7 +221,7 @@
offset = int(self.rest)
else:
offset = 0
- self.dtp.push(RETR_DATA[offset:])
+ self.dtp.push(self.next_retr_data[offset:])
self.dtp.close_when_done()
self.rest = None
@@ -242,6 +243,11 @@
self.dtp.push(MLSD_DATA)
self.dtp.close_when_done()
+ def cmd_setlongretr(self, arg):
+ # For testing. Next RETR will return long line.
+ self.next_retr_data = 'x' * int(arg)
+ self.push('125 setlongretr ok')
+
class DummyFTPServer(asyncore.dispatcher, threading.Thread):
@@ -758,6 +764,20 @@
self.assertEqual(ftplib.parse257('257 "/foo/b""ar"'), '/foo/b"ar')
self.assertEqual(ftplib.parse257('257 "/foo/b""ar" created'), '/foo/b"ar')
+ def test_line_too_long(self):
+ self.assertRaises(ftplib.Error, self.client.sendcmd,
+ 'x' * self.client.maxline * 2)
+
+ def test_retrlines_too_long(self):
+ self.client.sendcmd('SETLONGRETR %d' % (self.client.maxline * 2))
+ received = []
+ self.assertRaises(ftplib.Error,
+ self.client.retrlines, 'retr', received.append)
+
+ def test_storlines_too_long(self):
+ f = io.BytesIO(b'x' * self.client.maxline * 2)
+ self.assertRaises(ftplib.Error, self.client.storlines, 'stor', f)
+
class TestIPv6Environment(TestCase):
diff --git a/Misc/NEWS b/Misc/NEWS
index efe7cb8..dfce8a7 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -78,6 +78,10 @@
Library
-------
+- Issue #16038: CVE-2013-1752: ftplib: Limit amount of data read by
+ limiting the call to readline(). Original patch by Michał
+ Jastrzębski and Giampaolo Rodola.
+
- Issue #18235: Fix the sysconfig variables LDSHARED and BLDSHARED under AIX.
Patch by David Edelsohn.