From 489e9350385d54e5db4b811d850f725eb59a3b24 Mon Sep 17 00:00:00 2001 From: "Paul J. Davis" Date: Wed, 4 Jul 2012 15:52:29 -0500 Subject: [PATCH] Fix request line length check We were accidentally including partial data when we didn't find the request line terminating '\r\n'. This changes the check to make sure we're testing the length after we assert there's no termination. --- gunicorn/http/message.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gunicorn/http/message.py b/gunicorn/http/message.py index 4f7dfe5a..e2c75006 100644 --- a/gunicorn/http/message.py +++ b/gunicorn/http/message.py @@ -165,12 +165,13 @@ class Request(Message): idx = data.find("\r\n") if idx >= 0: break - self.get_data(unreader, buf) - data = buf.getvalue() if len(data) - 2 > self.limit_request_line > 0: raise LimitRequestLine(len(data), self.limit_request_line) + self.get_data(unreader, buf) + data = buf.getvalue() + self.parse_request_line(data[:idx]) buf = StringIO() buf.write(data[idx+2:]) # Skip \r\n