# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1471524522 -7200
# Node ID 3dc52f1778db8c324a9104010721fd05e69e880e
# Parent  d3646443a02ec7dc8f0d62bb7477b5922157563d
net.http.parser: Add a limit on maximum buffer size, default to 20M

diff -r d3646443a02e -r 3dc52f1778db net/http/parser.lua
--- a/net/http/parser.lua	Thu Aug 18 14:47:58 2016 +0200
+++ b/net/http/parser.lua	Thu Aug 18 14:48:42 2016 +0200
@@ -30,6 +30,7 @@
 	if not parser_type or parser_type == "server" then client = false; else assert(parser_type == "client", "Invalid parser type"); end
 	local buf, buflen, buftable = {}, 0, true;
 	local bodylimit = 10*1024*1024;
+	local buflimit = bodylimit * 2;
 	local chunked, chunk_size, chunk_start;
 	local state = nil;
 	local packet;
@@ -56,6 +57,7 @@
 				buftable = true;
 			end
 			buflen = buflen + #data;
+			if buflen > buflimit then error = true; return error_cb("max-buffer-size-exceeded"); end
 			while buflen > 0 do
 				if state == nil then -- read request
 					if buftable then buf, buftable = t_concat(buf), false; end