From: Ben Darnell <ben@bendarnell.com>
Date: Wed, 5 Aug 2026 18:13:32 +0000 (-0400)
Subject: httputil: Apply multipart max_parts limit earlier
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d666f7779a752d756a243e142ff5df4f30d0a397;p=thirdparty%2Ftornado.git

httputil: Apply multipart max_parts limit earlier

This prevents some CPU and memory amplification attacks.
---

diff --git a/tornado/httputil.py b/tornado/httputil.py
index 4bd17786..03e1f638 100644
--- a/tornado/httputil.py
+++ b/tornado/httputil.py
@@ -1089,7 +1089,9 @@ def parse_multipart_form_data(
     final_boundary_index = data.rfind(b"--" + boundary + b"--")
     if final_boundary_index == -1:
         raise HTTPInputError("Invalid multipart/form-data: no final boundary found")
-    parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n")
+    parts = data[:final_boundary_index].split(
+        b"--" + boundary + b"\r\n", config.max_parts + 1
+    )
     if len(parts) > config.max_parts:
         raise HTTPInputError("multipart/form-data has too many parts")
     for part in parts: