CVE-2012-0845: Medium severity python 2.7 vulnerability

Description of problem:

When using SimpleXMLRPCServer from the standard library, if a client connection is closed before the complete request body has been received the server will enter an infinite loop consuming memory.

Version-Release number of selected component (if applicable):

python-2.6.6-29.el6.x8664

How reproducible:

always

Steps to Reproduce:

1. Start the server: >>> import SimpleXMLRPCServer, SocketServer >>> class Server(SocketServer.ThreadingMixIn, SimpleXMLRPCServer.SimpleXMLRPCServer): pass ... >>> Server(('0.0.0.0', 12345)).serveforever()

2. Simulate a malicious or flakey client: $ echo -e 'POST /RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nlol bye' | nc localhost 12345 ^C

Actual results:

Server goes nuts, with a thread stuck in an infinite loop eating memory.

Expected results:

Bad request is discarded.

Additional info:

The bug is in /usr/lib64/python2.6/SimpleXMLRPCServer.py at line 453:

# Get arguments by reading body of request. # We read this in chunks to avoid straining # socket.read(); around the 10 or 15Mb mark, some platforms # begin to have problems (bug #792570). maxchunksize = 1010241024 sizeremaining = int(self.headers["content-length"]) L = [] while sizeremaining: chunksize = min(sizeremaining, maxchunksize) L.append(self.rfile.read(chunksize)) sizeremaining -= len(L[-1]) data = ''.join(L)

This code does not correctly handle EOF from self.rfile.read().