Multi-segment input is fully copied (body included) before header limits are enforced #65

Severity: Medium — 2026-10-30 security review

TryExtractFullHeaderValidated checks completeness, then does input.ToArray() on the whole sequence before MaxTotalHeaderBytes is checked (the check happens inside the ROM parse):

• src/Glyph11/Parser/UltraHardened/UltraHardenedParser.TryExtractFullHeader.cs:41 (requests)
• src/Glyph11/Parser/UltraHardened/UltraHardenedParser.TryExtractFullHeader.cs:47 (responses)
• bindings/dotnet/Glyph11.Pico/PicoParser.cs:110

That copy includes any pipelined body. An attacker pipelines a huge body behind a tiny header and forces an unbounded allocation.

Fix: linearize at most max(limit, headerEnd + 4) bytes.