bpo-44022: Fix http client infinite line reading (DoS) after a http 100

Lib/http/client.py

@@ -309,9 +309,12 @@ def begin(self):
             if status != CONTINUE:
                 break
             # skip the header from the 100 response
+            header_total_size = 0
             while True:
                 skip = self.fp.readline(_MAXLINE + 1)
-                if len(skip) > _MAXLINE:
+                line_length = len(skip)
+                header_total_size += line_length
+                if line_length > _MAXLINE or header_total_size > _MAXLINE:
                     raise LineTooLong("header line")
                 skip = skip.strip()
                 if not skip:

Lib/test/test_httplib.py

@@ -1180,6 +1180,14 @@ def test_overflowing_header_line(self):
         resp = client.HTTPResponse(FakeSocket(body))
         self.assertRaises(client.LineTooLong, resp.begin)
 
+    def test_overflowing_total_header_size_after_100(self):
+        body = (
+            'HTTP/1.1 100 OK\r\n'
+            'r\n' * 32768
+        )
+        resp = client.HTTPResponse(FakeSocket(body))
+        self.assertRaises(client.LineTooLong, resp.begin)
+
     def test_overflowing_chunked_line(self):
         body = (
             'HTTP/1.1 200 OK\r\n'

Misc/NEWS.d/next/Security/2021-05-05-17-37-04.bpo-44022.bS3XJ9.rst

@@ -0,0 +1 @@
+Added total header size limit after receving http 100 to httplib client for avoiding malicious server packet causing client hangs.