Bound the maximum buffer size for response headers.

http://code.google.com/p/chromium/issues/detail?id=3654

Review URL: http://codereview.chromium.org/7882

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@3827 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 10 insertions, 0 deletions

diff --git a/net/http/http_network_transaction.h b/net/http/http_network_transaction.h
index 7fd0b3c..dc850b5 100644
--- a/net/http/http_network_transaction.h
+++ b/net/http/http_network_transaction.h
@@ -206,7 +206,17 @@ class HttpNetworkTransaction : public HttpTransaction {
   int header_buf_capacity_;
   int header_buf_len_;
   int header_buf_body_offset_;
+
+  // The number of bytes by which the header buffer is grown when it reaches
+  // capacity.
   enum { kHeaderBufInitialSize = 4096 };
+
+  // |kMaxHeaderBufSize| is the number of bytes that the response headers can
+  // grow to. If the body start is not found within this range of the
+  // response, the transaction will fail with ERR_RESPONSE_HEADERS_TOO_BIG.
+  // Note: |kMaxHeaderBufSize| should be a multiple of |kHeaderBufInitialSize|.
+  enum { kMaxHeaderBufSize = 32768 };  // 32 kilobytes.
+
   // The position where status line starts; -1 if not found yet.
   int header_buf_http_offset_;