benoitc/gunicorn — pull request #670 by gnotaras (2013-12-19 01:45:54+00:00)
Title: Fixed the request line length check.

Hello. This patch is related to #376.

I checked the code thoroughly and it seems the [read_line() method](https://github.com/benoitc/gunicorn/blob/master/gunicorn/http/message.py#L206) has a bug.

For example, suppose that 2 buffer reads are required to read the full request data. The first part of the data is 10 bytes, which is less than the RequestLineLimit, and contains no CRLF. The second part of the data is bigger. The total length of the two parts together exceeds the RequestLineLimit.

In such a case, the current implementation of the check **never checks the request data for a CRLF after the second part is read from the buffer**!

In my case, the first read of the buffer was 1 byte. The second was bigger than the RequestLineLimit. The request line was way smaller than the request limit, but ``read_line()`` actually never found the CRLF, because it had raised the ``LimitRequestLine`` exception before doing so.

Hopefully this patch fixes the bug and makes ``read_line()`` correctly evaluate the length of the request line in all cases, regardless of how many buffer reads are required. The ``LimitRequestLine`` exception will only be raised if the CRLF position or the length of the read data is beyond the RequestLineLimit.

This bug has "tortured" me several times. Please review this patch.

Thanks in advance.