Chunked decoding has no resource ceiling: unbounded chunk buffering and unlimited trailers #63

Severity: High — 2026-10-30 security review

ParserLimits caps headers, URL, query params… but nothing caps a chunk or the trailer section. Two gaps, both trivially reachable DoS against a library whose selling point is configurable limits.

(a) Unbounded chunk buffering

The managed ChunkedBodyStream returns NeedMoreData until the entire chunk is buffered:

• src/Glyph11/Parser/ChunkedBodyStream.cs:181-197 (span overload)
• src/Glyph11/Parser/ChunkedBodyStream.cs:384-395 (sequence overload)

A client that declares FFFFFFFF and streams forever makes the caller's window grow unbounded.

(b) Unlimited trailers

Trailers have no count/byte cap (src/Glyph11/Parser/ChunkedBodyStream.cs:225-264; C: core/src/glyph11.c:699-707) even though chunk extensions are capped at 4096 bytes — endless X: y\r\n lines after the 0-chunk bypass MaxTotalHeaderBytes entirely and are consumed forever.

Related: #62 covers the chunk-size values ≥ 2^63 going negative in these same parsers.

Fix: add MaxChunkSize/MaxTrailerBytes limits (and ideally stream partial chunks like the C decoder does).