From: Brad Fitzpatrick <bradfitz@golang.org>
Date: Tue, 16 Dec 2014 03:06:53 +0000 (+1100)
Subject: net/textproto: turn an ancient DoS BUG annotation into a comment
X-Git-Tag: go1.5beta1~2623
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=3185f8620c35e7a6f54b6830c4833528c9878407;p=gostls13.git

net/textproto: turn an ancient DoS BUG annotation into a comment

Actually fixing this "bug" would be weird, since io.LimitReader already
does what we need, as demonstrated by net/http's use.

Thanks to @davidfstr for pointing this out.

Change-Id: If707bcc698d1666a369b39ddfa9770685fbe3879
Reviewed-on: https://go-review.googlesource.com/1579
Reviewed-by: Rob Pike <r@golang.org>
---

diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go
index eea9207f25..09b3352edd 100644
--- a/src/net/textproto/reader.go
+++ b/src/net/textproto/reader.go
@@ -13,10 +13,6 @@ import (
 	"strings"
 )
 
-// BUG(rsc): To let callers manage exposure to denial of service
-// attacks, Reader should allow them to set and reset a limit on
-// the number of bytes read from the connection.
-
 // A Reader implements convenience methods for reading requests
 // or responses from a text protocol network connection.
 type Reader struct {
@@ -26,6 +22,10 @@ type Reader struct {
 }
 
 // NewReader returns a new Reader reading from r.
+//
+// To avoid denial of service attacks, the provided bufio.Reader
+// should be reading from an io.LimitReader or similar Reader to bound
+// the size of responses.
 func NewReader(r *bufio.Reader) *Reader {
 	return &Reader{R: r}
 }