rc-httpd bug

[BurnZeZ@feline.systems]

lachs0r pointed out a bug involving the request handling.
When someone makes a request, rc-httpd does not limit the size of the request.
It loops getting lines until the request is complete, or rc runs out of memory.

fn getline{ read | sed 's/'^$"cr^'$//g' }

done=false
while(~ $"done false){
	line=`{getline}
	if(~ $#line 0)
		done=true
	reqlines=$"reqlines$"line'
'

The preceding excerpts should make the problem apparent.
See /rc/bin/rc-httpd/rc-httpd:/^done/

Another thing of note is that read(1) as used here will read until newline
with no regard for how much data is read.

RFC2616 section 10.4.14 speaks of a response, 413 Request Entity Too Large

>   The server is refusing to process a request because the request
>   entity is larger than the server is willing or able to process. The
>   server MAY close the connection to prevent the client from continuing
>   the request.
>
>   If the condition is temporary, the server SHOULD include a Retry-
>   After header field to indicate that it is temporary and after what
>   time the client MAY try again.

This definition leaves it up to the server to decide how much crap it tolerates.
From a quick glance at a few http server implementations, I see limits varying from 1-48 KB.
I'm not familiar enough with http to know how to impose such a limitation without
breaking things.