For connection-based transports, as soon as the Content-Length header is parsed, a buffer is allocated with the capacity specified by the Content-Length header. Right now, this value is limited to a maximum of 10MB. We need to either:
A) Make this maximum size configurable.
B) Refactor so that we aren't allocating the entire buffer in one go. This will
allow a higher maximum, since the sender will actually need to send the bits to get us to alloc the memory. (Instead of just DoSing us by sending a big number in the Content-Length)
I think the proper solution is to do B.
So, we have refactored to allocate the buffer piecemeal, but we are also putting a hard upper limit on what we are willing to accept. We should probably make this configurable, but it isn't as high a priority.