2.x backport of [1533] (Fixed serious buglet in SizeCheckWrapper which allowed unmonitored read.)

2 files changed, 9 insertions, 8 deletions

diff --git a/cherrypy/_cpwsgiserver.py b/cherrypy/_cpwsgiserver.py
index fe20685b..4a32e53a 100644
--- a/cherrypy/_cpwsgiserver.py
+++ b/cherrypy/_cpwsgiserver.py
@@ -323,9 +323,16 @@ class CherryPyWSGIServer(object):
             # AF_INET or AF_INET6 socket
             # Get the correct address family for our host (allows IPv6 addresses)
             host, port = self.bind_addr
+            flags = 0
+            if host == '':
+                # Despite the socket module docs, using '' does not
+                # allow AI_PASSIVE to work. Passing None instead
+                # returns '0.0.0.0' like we want.
+                host = None
+                flags = socket.AI_PASSIVE
             try:
                 info = socket.getaddrinfo(host, port, socket.AF_UNSPEC,
-                                          socket.SOCK_STREAM)
+                                          socket.SOCK_STREAM, 0, flags)
             except socket.gaierror:
                 # Probably a DNS issue. Assume IPv4.
                 self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
diff --git a/cherrypy/lib/httptools.py b/cherrypy/lib/httptools.py
index 6ba2362e..3d1b3031 100644
--- a/cherrypy/lib/httptools.py
+++ b/cherrypy/lib/httptools.py
@@ -560,17 +560,11 @@ class SizeCheckWrapper(object):
         self.rfile.close()
     
     def __iter__(self):
-        return self.rfile
+        return self
     
     def next(self):
         data = self.rfile.next()
         self.bytes_read += len(data)
         self._check_length()
-##      Normally the next method must raise StopIteration when it
-##      fails but CP expects MaxSizeExceeded 
-##        try:
-##            self._check_length()
-##        except:
-##            raise StopIteration()
         return data