httputil: Apply multipart max_parts limit earlier

This prevents some CPU and memory amplification attacks.

diff --git a/tornado/httputil.py b/tornado/httputil.py
index 4bd17786d2ea5484327b41d473bbabffbe1a949f..03e1f638cbb4dc65ee09d70c70cdc66c114e628e 100644 (file)
--- a/tornado/httputil.py
+++ b/tornado/httputil.py
@@ -1089,7 +1089,9 @@ def parse_multipart_form_data(
     final_boundary_index = data.rfind(b"--" + boundary + b"--")
     if final_boundary_index == -1:
         raise HTTPInputError("Invalid multipart/form-data: no final boundary found")
-    parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")
+    parts = data[:final_boundary_index].split(
+        b"--" + boundary + b"\r\n", config.max_parts + 1
+    )
     if len(parts) > config.max_parts:
         raise HTTPInputError("multipart/form-data has too many parts")
     for part in parts: