Enforce max_line_size on fragmented request target and reason in C parser - #12826

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.14%. Comparing base (69344c6) to head (adbf5e5).
⚠️ Report is 516 commits behind head on master.

@@            Coverage Diff             @@
##           master   #12826      +/-   ##
==========================================
+ Coverage   98.94%   99.14%   +0.20%     
==========================================
  Files         131      128       -3     
  Lines       47099    46424     -675     
  Branches     2435     2435              
==========================================
- Hits        46600    46027     -573     
+ Misses        376      274     -102     
  Partials      123      123              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

PR Review — Enforce max_line_size on fragmented request target and reason in C parser

Correct, minimal fix that closes a real bypass of max_line_size in the C parser. Merge-ready.

• len(pyparser._buf) + length > pyparser._max_line_size is the right invariant: _buf is reset on message begin (line 774) and drained in _on_status_complete (lines 690-694, 760-763), so it accumulates exactly the URL or reason fragments and nothing else.
• Error-message construction (pyparser._buf + at[:length], truncated to 100 chars) is unchanged, so the existing LineTooLong payload still reflects the full accumulated line.
• Tests cover both on_url and on_status fragmentation paths with fragment sizes that stay individually under the limit but accumulate past it — exactly the regression window the patch closes.
• Changelog fragment CHANGES/12826.bugfix.rst is well-scoped and attributes correctly. Behavior now matches the pure-Python parser, as the PR description claims.

Checklist

• Logic correctly enforces the limit on the accumulated buffer
• Error message format preserved
• Buffer lifetime safe (reset between messages, not shared with headers)
• Tests cover the fragmented case for both URL and status
• Changelog fragment present and correctly attributed
• No untested branches introduced

Automated review by Kōan (Claude) HEAD=6ba0839

Merging this PR will not alter performance

✅ 72 untouched benchmarks
⏩ 72 skipped benchmarks¹

_{Comparing c-parser-fragmented-line-limit (adbf5e5) with master (69344c6)}

Backport to 3.14: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 36df6c1 on top of patchback/backports/3.14/36df6c138d10c5776a25c69b698c41153d84d571/pr-12826

Backporting merged PR #12826 into master

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   $ git remote add upstream https://github.com/aio-libs/aiohttp.git

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   $ git fetch upstream
   $ git checkout -b patchback/backports/3.14/36df6c138d10c5776a25c69b698c41153d84d571/pr-12826 upstream/3.14

4. Now, cherry-pick PR Enforce max_line_size on fragmented request target and reason in C parser #12826 contents into that branch:

   $ git cherry-pick -x 36df6c138d10c5776a25c69b698c41153d84d571

   If it'll yell at you with something like fatal: Commit 36df6c138d10c5776a25c69b698c41153d84d571 is a merge but no -m option was given., add -m 1 as follows instead:

   $ git cherry-pick -m1 -x 36df6c138d10c5776a25c69b698c41153d84d571

5. At this point, you'll probably encounter some merge conflicts. You must
   resolve them in to preserve the patch from PR Enforce max_line_size on fragmented request target and reason in C parser #12826 as close to the
   original as possible.
6. Push this branch to your fork on GitHub:

   $ git push origin patchback/backports/3.14/36df6c138d10c5776a25c69b698c41153d84d571/pr-12826

7. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

Backport to 3.15: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 36df6c1 on top of patchback/backports/3.15/36df6c138d10c5776a25c69b698c41153d84d571/pr-12826

Backporting merged PR #12826 into master

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   $ git remote add upstream https://github.com/aio-libs/aiohttp.git

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   $ git fetch upstream
   $ git checkout -b patchback/backports/3.15/36df6c138d10c5776a25c69b698c41153d84d571/pr-12826 upstream/3.15

4. Now, cherry-pick PR Enforce max_line_size on fragmented request target and reason in C parser #12826 contents into that branch:

   $ git cherry-pick -x 36df6c138d10c5776a25c69b698c41153d84d571

   If it'll yell at you with something like fatal: Commit 36df6c138d10c5776a25c69b698c41153d84d571 is a merge but no -m option was given., add -m 1 as follows instead:

   $ git cherry-pick -m1 -x 36df6c138d10c5776a25c69b698c41153d84d571

5. At this point, you'll probably encounter some merge conflicts. You must
   resolve them in to preserve the patch from PR Enforce max_line_size on fragmented request target and reason in C parser #12826 as close to the
   original as possible.
6. Push this branch to your fork on GitHub:

   $ git push origin patchback/backports/3.15/36df6c138d10c5776a25c69b698c41153d84d571/pr-12826

7. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.