The fix for #900744 tried to close the connection when a bad chunk length was received. The comment inserted with that fix "close the connection as protocol synchronisation is probably lost" is incorrect: self.close() in _read_chunked does not close the connection. You have to call HTTPConnection.close() to close the connection. So: * The comment is incorrect, and should be removed or fixed. I guess the self.close() should stay. * It's probably a bug that it doesn't result in the connection being closed. I guess a fix for that would be for the HTTPResponse to set some state on itself that HTTPConnection can query so that HTTPConnection can close itself the next time somebody tries to do something with the connection.
Another fix could be making HTTPResponse to hold a reference to the HTTPConnection object and call its close() at the time of a bad chunk length was received. This can close the connection as soon as possible.
