summaryrefslogtreecommitdiffstats
path: root/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-53643.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-53643.patch')
-rw-r--r--meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-53643.patch197
1 files changed, 197 insertions, 0 deletions
diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-53643.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-53643.patch
new file mode 100644
index 0000000000..19eef35bb2
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-53643.patch
@@ -0,0 +1,197 @@
1From 4c4dec318f21e2eae9c69cd5b83cb54b4f9bb746 Mon Sep 17 00:00:00 2001
2From: Sam Bull <git@sambull.org>
3Date: Wed, 9 Jul 2025 19:55:22 +0100
4Subject: [PATCH] Add trailer parsing logic (#11269) (#11287)
5
6(cherry picked from commit 7dd4b5535e6bf9c2d2f05fde638517bff065ba74)
7
8CVE: CVE-2025-53643
9
10Upstream-Status: Backport
11[https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a]
12
13Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
14---
15 aiohttp/http_parser.py | 70 ++++++++++++++++++++++--------------------
16 aiohttp/multipart.py | 2 +-
17 2 files changed, 38 insertions(+), 34 deletions(-)
18
19diff --git a/aiohttp/http_parser.py b/aiohttp/http_parser.py
20index 1ee126940..175eb7f68 100644
21--- a/aiohttp/http_parser.py
22+++ b/aiohttp/http_parser.py
23@@ -147,8 +147,8 @@ class HeadersParser:
24 headers: CIMultiDict[str] = CIMultiDict()
25 raw_headers = []
26
27- lines_idx = 1
28- line = lines[1]
29+ lines_idx = 0
30+ line = lines[lines_idx]
31 line_count = len(lines)
32
33 while line:
34@@ -386,6 +386,7 @@ class HttpParser(abc.ABC, Generic[_MsgT]):
35 response_with_body=self.response_with_body,
36 auto_decompress=self._auto_decompress,
37 lax=self.lax,
38+ headers_parser=self._headers_parser,
39 )
40 if not payload_parser.done:
41 self._payload_parser = payload_parser
42@@ -405,6 +406,7 @@ class HttpParser(abc.ABC, Generic[_MsgT]):
43 readall=True,
44 auto_decompress=self._auto_decompress,
45 lax=self.lax,
46+ headers_parser=self._headers_parser,
47 )
48 else:
49 if (
50@@ -429,6 +431,7 @@ class HttpParser(abc.ABC, Generic[_MsgT]):
51 response_with_body=self.response_with_body,
52 auto_decompress=self._auto_decompress,
53 lax=self.lax,
54+ headers_parser=self._headers_parser,
55 )
56 if not payload_parser.done:
57 self._payload_parser = payload_parser
58@@ -462,6 +465,10 @@ class HttpParser(abc.ABC, Generic[_MsgT]):
59
60 eof = True
61 data = b""
62+ if isinstance(
63+ underlying_exc, (InvalidHeader, TransferEncodingError)
64+ ):
65+ raise
66
67 if eof:
68 start_pos = 0
69@@ -617,7 +624,7 @@ class HttpRequestParser(HttpParser[RawRequestMessage]):
70 compression,
71 upgrade,
72 chunked,
73- ) = self.parse_headers(lines)
74+ ) = self.parse_headers(lines[1:])
75
76 if close is None: # then the headers weren't set in the request
77 if version_o <= HttpVersion10: # HTTP 1.0 must asks to not close
78@@ -696,7 +703,7 @@ class HttpResponseParser(HttpParser[RawResponseMessage]):
79 compression,
80 upgrade,
81 chunked,
82- ) = self.parse_headers(lines)
83+ ) = self.parse_headers(lines[1:])
84
85 if close is None:
86 close = version_o <= HttpVersion10
87@@ -727,6 +734,8 @@ class HttpPayloadParser:
88 response_with_body: bool = True,
89 auto_decompress: bool = True,
90 lax: bool = False,
91+ *,
92+ headers_parser: HeadersParser,
93 ) -> None:
94 self._length = 0
95 self._type = ParseState.PARSE_NONE
96@@ -735,6 +744,8 @@ class HttpPayloadParser:
97 self._chunk_tail = b""
98 self._auto_decompress = auto_decompress
99 self._lax = lax
100+ self._headers_parser = headers_parser
101+ self._trailer_lines: list[bytes] = []
102 self.done = False
103
104 # payload decompression wrapper
105@@ -822,7 +833,7 @@ class HttpPayloadParser:
106 size_b = chunk[:i] # strip chunk-extensions
107 # Verify no LF in the chunk-extension
108 if b"\n" in (ext := chunk[i:pos]):
109- exc = BadHttpMessage(
110+ exc = TransferEncodingError(
111 f"Unexpected LF in chunk-extension: {ext!r}"
112 )
113 set_exception(self.payload, exc)
114@@ -843,7 +854,7 @@ class HttpPayloadParser:
115
116 chunk = chunk[pos + len(SEP) :]
117 if size == 0: # eof marker
118- self._chunk = ChunkState.PARSE_MAYBE_TRAILERS
119+ self._chunk = ChunkState.PARSE_TRAILERS
120 if self._lax and chunk.startswith(b"\r"):
121 chunk = chunk[1:]
122 else:
123@@ -881,38 +892,31 @@ class HttpPayloadParser:
124 self._chunk_tail = chunk
125 return False, b""
126
127- # if stream does not contain trailer, after 0\r\n
128- # we should get another \r\n otherwise
129- # trailers needs to be skiped until \r\n\r\n
130- if self._chunk == ChunkState.PARSE_MAYBE_TRAILERS:
131- head = chunk[: len(SEP)]
132- if head == SEP:
133- # end of stream
134- self.payload.feed_eof()
135- return True, chunk[len(SEP) :]
136- # Both CR and LF, or only LF may not be received yet. It is
137- # expected that CRLF or LF will be shown at the very first
138- # byte next time, otherwise trailers should come. The last
139- # CRLF which marks the end of response might not be
140- # contained in the same TCP segment which delivered the
141- # size indicator.
142- if not head:
143- return False, b""
144- if head == SEP[:1]:
145- self._chunk_tail = head
146- return False, b""
147- self._chunk = ChunkState.PARSE_TRAILERS
148-
149- # read and discard trailer up to the CRLF terminator
150 if self._chunk == ChunkState.PARSE_TRAILERS:
151 pos = chunk.find(SEP)
152- if pos >= 0:
153- chunk = chunk[pos + len(SEP) :]
154- self._chunk = ChunkState.PARSE_MAYBE_TRAILERS
155- else:
156+ if pos < 0: # No line found
157 self._chunk_tail = chunk
158 return False, b""
159
160+ line = chunk[:pos]
161+ chunk = chunk[pos + len(SEP) :]
162+ if SEP == b"\n": # For lax response parsing
163+ line = line.rstrip(b"\r")
164+ self._trailer_lines.append(line)
165+
166+ # \r\n\r\n found, end of stream
167+ if self._trailer_lines[-1] == b"":
168+ # Headers and trailers are defined the same way,
169+ # so we reuse the HeadersParser here.
170+ try:
171+ trailers, raw_trailers = self._headers_parser.parse_headers(
172+ self._trailer_lines
173+ )
174+ finally:
175+ self._trailer_lines.clear()
176+ self.payload.feed_eof()
177+ return True, chunk
178+
179 # Read all bytes until eof
180 elif self._type == ParseState.PARSE_UNTIL_EOF:
181 self.payload.feed_data(chunk, len(chunk))
182diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
183index 9cd49bb5d..2457f80ec 100644
184--- a/aiohttp/multipart.py
185+++ b/aiohttp/multipart.py
186@@ -718,7 +718,7 @@ class MultipartReader:
187 raise ValueError(f"Invalid boundary {chunk!r}, expected {self._boundary!r}")
188
189 async def _read_headers(self) -> "CIMultiDictProxy[str]":
190- lines = [b""]
191+ lines = []
192 while True:
193 chunk = await self._content.readline()
194 chunk = chunk.strip()
195--
1962.34.1
197
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-13 13:54:10 +0000