]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.9] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#130248)
authorHugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Wed, 19 Feb 2025 13:31:01 +0000 (15:31 +0200)
committerGitHub <noreply@github.com>
Wed, 19 Feb 2025 13:31:01 +0000 (14:31 +0100)
commitf116a9c15cba87f6cac5724214ce267ad27c29c0
tree4b7708347ad6f2075386cb260c6bc69258121dcf
parentd80cbdd7084c9509d405d9091338a8bd9db90cd0
[3.9] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#130248)

The IMAP4 client could consume an arbitrary amount of memory when trying
to connect to a malicious server, because it read a "literal" data with a
single read(size) call, and BufferedReader.read() allocates the bytes
object of the specified size before reading. Now the IMAP4 client reads data
by chunks, therefore the amount of used memory is limited by the
amount of the data actually been sent by the server.
(cherry picked from commit 735f25c5e3a0f74438c86468ec4dfbe219d93c91)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Lib/imaplib.py
Lib/test/test_imaplib.py
Misc/NEWS.d/next/Security/2024-05-24-21-00-52.gh-issue-119511.jKrXQ8.rst [new file with mode: 0644]