return error when header too long

transport/internet/headers/http/http.go

@@ -2,6 +2,7 @@ package http
 
 import (
 	"bytes"
+	"errors"
 	"io"
 	"net"
 	"net/http"
@@ -17,10 +18,12 @@ const (
 	CRLF   = "\r\n"
 	ENDING = CRLF + CRLF
 
+	// max length of HTTP header. Safety precaution for DDoS attack.
 	maxHeaderLength = 8192
 )
 
 var (
+	ErrHeaderToLong = errors.New("Header too long.")
 	writeCRLF       = serial.WriteString(CRLF)
 )
 
@@ -50,6 +53,7 @@ type HeaderReader struct {
 func (*HeaderReader) Read(reader io.Reader) (*buf.Buffer, error) {
 	buffer := buf.NewSmall()
 	totalBytes := 0
+	endingDetected := false
 	for totalBytes < maxHeaderLength {
 		err := buffer.AppendSupplier(buf.ReadFrom(reader))
 		if err != nil {
@@ -57,6 +61,7 @@ func (*HeaderReader) Read(reader io.Reader) (*buf.Buffer, error) {
 		}
 		if n := bytes.Index(buffer.Bytes(), []byte(ENDING)); n != -1 {
 			buffer.SliceFrom(n + len(ENDING))
+			endingDetected = true
 			break
 		}
 		if buffer.Len() >= len(ENDING) {
@@ -71,6 +76,10 @@ func (*HeaderReader) Read(reader io.Reader) (*buf.Buffer, error) {
 		buffer.Release()
 		return nil, nil
 	}
+	if !endingDetected {
+		buffer.Release()
+		return nil, ErrHeaderToLong
+	}
 	return buffer, nil
 }