merge with 3.3

1 files changed, 10 insertions, 1 deletions

diff --git a/Lib/poplib.py b/Lib/poplib.py
index be98a7dbeb..d68f16958c 100644
--- a/Lib/poplib.py
+++ b/Lib/poplib.py
@@ -40,6 +40,12 @@ CR = b'\r'
 LF = b'\n'
 CRLF = CR+LF
 
+# maximal line length when calling readline(). This is to prevent
+# reading arbitrary lenght lines. RFC 1939 limits POP3 line length to
+# 512 characters, including CRLF. We have selected 2048 just to be on
+# the safe side.
+_MAXLINE = 2048
+
 
 class POP3:
 
@@ -118,7 +124,10 @@ class POP3:
     # Raise error_proto('-ERR EOF') if the connection is closed.
 
     def _getline(self):
-        line = self.file.readline()
+        line = self.file.readline(_MAXLINE + 1)
+        if len(line) > _MAXLINE:
+            raise error_proto('line too long')
+
         if self._debugging > 1: print('*get*', repr(line))
         if not line: raise error_proto('-ERR EOF')
         octets = len(line)