This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: nntplib throws exceptions making sinntp unusable
Type: crash Stage:
Components: Library (Lib) Versions: Python 2.7
process
Status: closed Resolution: third party
Dependencies: Superseder:
Assigned To: Nosy List: jwilk, randomcoder1
Priority: normal Keywords:

Created on 2014-04-23 09:42 by randomcoder1, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
bureport-data.tgz randomcoder1, 2014-04-23 09:42
Messages (5)
msg217060 - (view) Author: (randomcoder1) Date: 2014-04-23 09:42
Sinntp is a nntp client. It uses nntplib from Python as a nntp library to fetch messages from NNTP servers.

I've tested this on two environments with the following package versions:

1) Ubuntu 12.04.4 , python-support 1.0.14ubuntu2, Python 2.7.3-0ubuntu2.2 , sinntp 1.4-1 , libpython2.7 2.7.3-0ubuntu3.4
2) Debian jessie , python-support 1.0.15, Python 2.7.5-5, sinntp 1.5-1 , libpython2.7 version 2.7.6-8

sinntp crashed on 2) and threw NNTP* exceptions which are described in more detail in the bugreport-data.tgz file that comes with this  bugreport. I was also able to isolate one NNTP article that caused it to crash, that's also included.

I've included above the libpython2.7 version because
user@machine:/tmp$ sudo apt-file -x search 'nntplib.py$'
[..]
libpython2.7-stdlib: /usr/lib/python2.7/nntplib.py
[..]

Upon trying to replace the sinntp 1.5-1 on 2) with the one in 1) , the problem was still present, so I believe sinntp can be excluded.

I think the bug is caused by the newer version of libpython2.7 in 2).
msg217061 - (view) Author: (randomcoder1) Date: 2014-04-23 09:46
I'm cross-referencing this here too. https://code.google.com/p/sinntp/issues/detail?id=9
msg217062 - (view) Author: (randomcoder1) Date: 2014-04-23 09:54
I forgot to mention that in the environment 1) described above, everything worked fine.
msg217063 - (view) Author: Jakub Wilk (jwilk) Date: 2014-04-23 10:52
For the reference, the exception is:

Traceback (most recent call last):
  File "/home/user/sources/sinntp/sinntp", line 357, in <module>
    connection.quit()
  File "/usr/lib/python2.7/nntplib.py", line 608, in quit
    resp = self.shortcmd('QUIT')
  File "/usr/lib/python2.7/nntplib.py", line 268, in shortcmd
    return self.getresp()
  File "/usr/lib/python2.7/nntplib.py", line 223, in getresp
    resp = self.getline()
  File "/usr/lib/python2.7/nntplib.py", line 212, in getline
    raise NNTPDataError('line too long')
nntplib.NNTPDataError: line too long

The change in the behavior is intentional. The maximum line length has been limited to 2048 to prevent denial of service. This is issue #16040 aka CVE-2013-1752.

This is what relevant standards say:

RFC 3977 §3.1.1: “This document does not place any limit on the length of a line in a multi-line block. However, the standards that define the format of articles may do so.”
RFC 5322 §2.1.1: “Each line of characters MUST be no more than 998 characters, and SHOULD be no more than 78 characters, excluding the CRLF.”

The message that sinntp tripped over had lines longer than RFC 5322 permits, so it shouldn't have been accepted by the server in the first place.

I don't think there's much to be fixed on the Python side.

What could be improved is error handling in sinntp; but let's discuss this in the sinntp bug tracker. :)
msg217072 - (view) Author: (randomcoder1) Date: 2014-04-23 14:28
@Jakub Sure, I've submitted a patch in the sinntp googlecode issue tracker. When you have some time, please have a look at it.
History
Date User Action Args
2022-04-11 14:58:02adminsetgithub: 65533
2014-04-23 14:29:09randomcoder1setstatus: open -> closed
resolution: third party
2014-04-23 14:28:38randomcoder1setmessages: + msg217072
2014-04-23 10:52:48jwilksetnosy: + jwilk
messages: + msg217063
2014-04-23 09:54:20randomcoder1setmessages: + msg217062
2014-04-23 09:46:09randomcoder1setmessages: + msg217061
2014-04-23 09:42:41randomcoder1create