Patched code sample

import h11

def process_chunked_data(data):
    """
    Processes chunked data, strictly validating line endings.

    Args:
        data: The chunked data as bytes.

    Returns:
        The unchunked data as bytes, or None if an error occurs.
    """
    unprocessed_data = data
    output = b""
    while True:
        try:
            chunk_len, terminator_len = h11.util.read_chunk_len(unprocessed_data)
        except h11.RemoteProtocolError:
            print("Invalid chunk length format")
            return None

        if chunk_len is None:
            # End of chunked data
            return output

        chunk_start = terminator_len
        chunk_end = chunk_start + chunk_len

        try:
            chunk = unprocessed_data[chunk_start:chunk_end]
        except IndexError:
            print("Chunk length exceeds data length")
            return None

        output += chunk

        # **Strict line ending validation after each chunk:**
        expected_terminator = b"\r\n"
        actual_terminator = unprocessed_data[chunk_end:chunk_end + len(expected_terminator)]
        if actual_terminator != expected_terminator:
            print(f"Invalid chunk terminator: Expected {expected_terminator}, got {actual_terminator}")
            return None

        unprocessed_data = unprocessed_data[chunk_end + len(expected_terminator):]


# Example Usage: Demonstrating a correct vs. incorrect chunked body
def demonstrate_chunked_parsing():
    # Valid chunked data
    valid_chunked_data = b"5\r\nhello\r\n0\r\n\r\n"
    unchunked_valid = process_chunked_data(valid_chunked_data)
    print(f"Valid chunked data unchunked: {unchunked_valid}")  # Output: b'hello'

    # Invalid chunked data (using just '\n' instead of '\r\n')
    invalid_chunked_data = b"5\nhello\n0\n\n"  #Simulates CVE-2025-43859: lenient parsing of line terminators.
    unchunked_invalid = process_chunked_data(invalid_chunked_data)
    print(f"Invalid chunked data unchunked: {unchunked_invalid}") #Output: None


if __name__ == "__main__":
    demonstrate_chunked_parsing()