From 28e78414f9175774f26d8c564c7c1d3b078f99de Mon Sep 17 00:00:00 2001
From: Georg Brandl <georg@python.org>
Date: Sun, 27 Oct 2013 07:29:47 +0100
Subject: [PATCH] Issue #16040: CVE-2013-1752: nntplib: Limit maximum line
 lengths to 2048 to prevent readline() calls from consuming too much memory. 
 Patch by Jyrki Pulliainen.

---
 Lib/nntplib.py           | 11 ++++++++++-
 Lib/test/test_nntplib.py | 10 ++++++++++
 Misc/NEWS                |  4 ++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/Lib/nntplib.py b/Lib/nntplib.py
index 2de6ebd1b56..02cc37c1e21 100644
--- a/Lib/nntplib.py
+++ b/Lib/nntplib.py
@@ -85,6 +85,13 @@ __all__ = ["NNTP",
            "decode_header",
            ]
 
+# maximal line length when calling readline(). This is to prevent
+# reading arbitrary lenght lines. RFC 3977 limits NNTP line length to
+# 512 characters, including CRLF. We have selected 2048 just to be on
+# the safe side.
+_MAXLINE = 2048
+
+
 # Exceptions raised when an error or invalid response is received
 class NNTPError(Exception):
     """Base class for all nntplib exceptions"""
@@ -424,7 +431,9 @@ class _NNTPBase:
         """Internal: return one line from the server, stripping _CRLF.
         Raise EOFError if the connection is closed.
         Returns a bytes object."""
-        line = self.file.readline()
+        line = self.file.readline(_MAXLINE +1)
+        if len(line) > _MAXLINE:
+            raise NNTPDataError('line too long')
         if self.debugging > 1:
             print('*get*', repr(line))
         if not line: raise EOFError
diff --git a/Lib/test/test_nntplib.py b/Lib/test/test_nntplib.py
index 19fb10a9c71..5ab87c48bb2 100644
--- a/Lib/test/test_nntplib.py
+++ b/Lib/test/test_nntplib.py
@@ -584,6 +584,11 @@ class NNTPv1Handler:
                 <a4929a40-6328-491a-aaaf-cb79ed7309a2@q2g2000vbk.googlegroups.com>
                 <f30c0419-f549-4218-848f-d7d0131da931@y3g2000vbm.googlegroups.com>
                 .""")
+        elif (group == 'comp.lang.python' and
+              date_str in ('20100101', '100101') and
+              time_str == '090000'):
+            self.push_lit('too long line' * 3000 +
+                          '\n.')
         else:
             self.push_lit("""\
                 230 An empty list of newsarticles follows
@@ -1179,6 +1184,11 @@ class NNTPv1v2TestsMixin:
         self.assertEqual(cm.exception.response,
                          "435 Article not wanted")
 
+    def test_too_long_lines(self):
+        dt = datetime.datetime(2010, 1, 1, 9, 0, 0)
+        self.assertRaises(nntplib.NNTPDataError,
+                          self.server.newnews, "comp.lang.python", dt)
+
 
 class NNTPv1Tests(NNTPv1v2TestsMixin, MockedNNTPTestsMixin, unittest.TestCase):
     """Tests an NNTP v1 server (no capabilities)."""
diff --git a/Misc/NEWS b/Misc/NEWS
index 09cb5993691..24f18474342 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -81,6 +81,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #16040: CVE-2013-1752: nntplib: Limit maximum line lengths to 2048 to
+  prevent readline() calls from consuming too much memory.  Patch by Jyrki
+  Pulliainen.
+
 - Issue #16041: CVE-2013-1752: poplib: Limit maximum line lengths to 2048 to
   prevent readline() calls from consuming too much memory.  Patch by Jyrki
   Pulliainen.