Uncaught socket exception during timeout handling

cherrypy · Apr 1, 2024 · 7ce37c1 · 7ce37c1
1 parent 9720c31
commit 7ce37c1
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/cheroot/ssl/pyopenssl.py b/cheroot/ssl/pyopenssl.py
@@ -99,8 +99,14 @@ def _safe_call(self, is_reader, call, *args, **kwargs):  # noqa: C901
             except SSL.WantWriteError:
                 time.sleep(self.ssl_retry)
             except SSL.SysCallError as e:
-                if is_reader and e.args == (-1, 'Unexpected EOF'):
-                    return b''
+                if e.args == (-1, 'Unexpected EOF'):
+                    if is_reader:
+                        return b''
+                    else:
+                        # See #210. Prevents DOS attack caused by
+                        # silent connections lasting beyond connection
+                        # timeout length.
+                        raise errors.FatalSSLAlert(*e.args)
 
                 errnum = e.args[0]
                 if is_reader and errnum in errors.socket_errors_to_ignore: