#1627: httplib now ignores negative Content-Length headers.

Lib/httplib.py

@@ -438,6 +438,9 @@ class HTTPResponse:
                 self.length = int(length)
             except ValueError:
                 self.length = None
+            else:
+                if self.length < 0:  # ignore nonsensical negative lengths
+                    self.length = None
         else:
             self.length = None
 

Lib/test/test_httplib.py

@@ -184,6 +184,13 @@ class BasicTest(TestCase):
             finally:
                 resp.close()
 
+    def test_negative_content_length(self):
+        sock = FakeSocket('HTTP/1.1 200 OK\r\nContent-Length: -1\r\n\r\nHello\r\n')
+        resp = httplib.HTTPResponse(sock, method="GET")
+        resp.begin()
+        self.assertEquals(resp.read(), 'Hello\r\n')
+        resp.close()
+
 
 class OfflineTest(TestCase):
     def test_responses(self):

Misc/NEWS

@@ -441,6 +441,8 @@ Core and builtins
 Library
 -------
 
+- #1627: httplib now ignores negative Content-Length headers.
+
 - #900744: If an invalid chunked-encoding header is sent by a server,
   httplib will now raise IncompleteRead and close the connection instead
   of raising ValueError.