]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-119511: Fix a potential denial of service in imaplib (#119514)
authorSerhiy Storchaka <storchaka@gmail.com>
Mon, 27 Jan 2025 13:44:00 +0000 (15:44 +0200)
committerGitHub <noreply@github.com>
Mon, 27 Jan 2025 13:44:00 +0000 (14:44 +0100)
commit735f25c5e3a0f74438c86468ec4dfbe219d93c91
treee505d0187e85ad52e3501eb77295cc502ce69fd3
parent3fb5f6eb9b2b966142b576610210d2b491c1eebb
gh-119511: Fix a potential denial of service in imaplib (#119514)

The IMAP4 client could consume an arbitrary amount of memory when trying
to connect to a malicious server, because it read a "literal" data with a
single read(size) call, and BufferedReader.read() allocates the bytes
object of the specified size before reading. Now the IMAP4 client reads data
by chunks, therefore the amount of used memory is limited by the
amount of the data actually been sent by the server.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Lib/imaplib.py
Lib/test/test_imaplib.py
Misc/NEWS.d/next/Security/2024-05-24-21-00-52.gh-issue-119511.jKrXQ8.rst [new file with mode: 0644]