#1627: httplib now ignores negative Content-Length headers.

3 files changed, 12 insertions, 0 deletions

diff --git a/Lib/httplib.py b/Lib/httplib.py
index bb4b59e701..5696467bd1 100644
--- a/Lib/httplib.py
+++ b/Lib/httplib.py
@@ -438,6 +438,9 @@ class HTTPResponse:
                 self.length = int(length)
             except ValueError:
                 self.length = None
+            else:
+                if self.length < 0:  # ignore nonsensical negative lengths
+                    self.length = None
         else:
             self.length = None
 
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
index e9dd9d66c3..67719fd5e0 100644
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -184,6 +184,13 @@ class BasicTest(TestCase):
             finally:
                 resp.close()
 
+    def test_negative_content_length(self):
+        sock = FakeSocket('HTTP/1.1 200 OK\r\nContent-Length: -1\r\n\r\nHello\r\n')
+        resp = httplib.HTTPResponse(sock, method="GET")
+        resp.begin()
+        self.assertEquals(resp.read(), 'Hello\r\n')
+        resp.close()
+
 
 class OfflineTest(TestCase):
     def test_responses(self):
diff --git a/Misc/NEWS b/Misc/NEWS
index 9d9264e0e3..38b4730192 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -441,6 +441,8 @@ Core and builtins
 Library
 -------
 
+- #1627: httplib now ignores negative Content-Length headers.
+
 - #900744: If an invalid chunked-encoding header is sent by a server,
   httplib will now raise IncompleteRead and close the connection instead
   of raising ValueError.