head	1.2;
access;
symbols
	RELEASE_8_3_0:1.1;
locks; strict;
comment	@# @;


1.2
date	2012.04.11.12.52.17;	author miwi;	state dead;
branches;
next	1.1;

1.1
date	2012.02.18.17.53.53;	author miwi;	state Exp;
branches;
next	;


desc
@@


1.2
log
@- Update:
  * python26 -> 2.6.8
  * python27 -> 2.7.3
  * python31 -> 3.1.5
  * python32 -> 3.2.1

Security:	http://www.vuxml.org/freebsd/b4f8be9e-56b2-11e1-9fb7-003067b2972c.html
		CVE-2012-0845 CVE-2012-0876 CVE-2012-1150 CVE-2012-0845 CVE-2011-3389
@
text
@diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py
--- Lib/test/test_xmlrpc.py
+++ Lib/test/test_xmlrpc.py
@@@@ -519,12 +519,7 @@@@
 
     def tearDown(self):
         # wait on the server thread to terminate
-        self.evt.wait(4.0)
-        # XXX this code does not work, and in fact stop_serving doesn't exist.
-        if not self.evt.is_set():
-            self.evt.set()
-            stop_serving()
-            raise RuntimeError("timeout reached, test has failed")
+        self.evt.wait()
 
         # disable traceback reporting
         xmlrpc.server.SimpleXMLRPCServer._send_traceback_header = False
@@@@ -671,6 +666,13 @@@@
         server = xmlrpclib.ServerProxy("http://%s:%d/RPC2" % (ADDR, PORT))
         self.assertEqual(server.add("a", "\xe9"), "a\xe9")
 
+    def test_partial_post(self):
+        # Check that a partial POST doesn't make the server loop: issue #14001.
+        conn = http.client.HTTPConnection(ADDR, PORT)
+        conn.request('POST', '/RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nbye')
+        conn.close()
+
+
 class MultiPathServerTestCase(BaseServerTestCase):
     threadFunc = staticmethod(http_multi_server)
     request_count = 2
diff --git a/Lib/xmlrpc/server.py b/Lib/xmlrpc/server.py
--- Lib/xmlrpc/server.py
+++ Lib/xmlrpc/server.py
@@@@ -476,7 +476,10 @@@@
             L = []
             while size_remaining:
                 chunk_size = min(size_remaining, max_chunk_size)
-                L.append(self.rfile.read(chunk_size))
+                chunk = self.rfile.read(chunk_size)
+                if not chunk:
+                    break
+                L.append(chunk)
                 size_remaining -= len(L[-1])
             data = b''.join(L)
 
@


1.1
log
@- Mark Python as Secure
- Fix DoS via malformed XML-RPC / HTTP POST

Submitted by:	rm@@
Reported by:	many
Obtained from:	python hg
Security:	http://www.vuxml.org/freebsd/b4f8be9e-56b2-11e1-9fb7-003067b2972c.html
@
text
@@

