Reject Content-Length longer than 4300 digits

Author: Julien00859

h11/_headers.py

@@ -12,6 +12,12 @@
 except ImportError:
     from typing_extensions import Literal  # type: ignore
 
+try:
+    from sys import get_int_max_str_digits
+except ImportError:
+    def get_int_max_str_digits():
+        return 4300  # CPython default
+
 
 # Facts
 # -----
@@ -173,6 +179,8 @@ def normalize_and_validate(
                 raise LocalProtocolError("conflicting Content-Length headers")
             value = lengths.pop()
             validate(_content_length_re, value, "bad Content-Length")
+            if len(value) > get_int_max_str_digits():
+                raise LocalProtocolError("bad Content-Length")
             if seen_content_length is None:
                 seen_content_length = value
                 new_headers.append((raw_name, name, value))

h11/tests/test_headers.py

@@ -74,6 +74,8 @@ def test_normalize_and_validate() -> None:
         )
     with pytest.raises(LocalProtocolError):
         normalize_and_validate([("Content-Length", "1 , 1,2")])
+    with pytest.raises(LocalProtocolError):
+        normalize_and_validate([("Content-Length", "1" * 4301)])
 
     # transfer-encoding
     assert normalize_and_validate([("Transfer-Encoding", "chunked")]) == [