asyncore DoS vulnerability

paul paul at subsignal.org
Fri Feb 2 16:19:28 EST 2007


Jean-Paul Calderone schrieb:
> It could ask the application.  On the other hand, maybe asyncore remains in
> a perfectly consistent state even after it raises this exception, and it is
> already "asking" by letting this exception propagate up: if the application
> is free to start the loop again after this happens, then it seems everything
> is just fine; if some state becomes inconsistent, though, then asyncore should
> probably do something more (assuming asyncore applications are supposed to be
> able to be resistent to this kind of DoS).
I second that, especially given the rather unspecific nature of
"ValueError". Something like "EnvironmentError" or "OSError" would be
more appropriate. Problem is: such a change would break lots of code...

thanks
 Paul




More information about the Python-list mailing list