rpc: limit chunked requests (#16343)

1 files changed, 2 insertions, 1 deletions

diff --git a/rpc/http.go b/rpc/http.go
index 9805d69b6..e8f51150f 100644
--- a/rpc/http.go
+++ b/rpc/http.go
@@ -169,7 +169,8 @@ func (srv *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// All checks passed, create a codec that reads direct from the request body
 	// untilEOF and writes the response to w and order the server to process a
 	// single request.
-	codec := NewJSONCodec(&httpReadWriteNopCloser{r.Body, w})
+	body := io.LimitReader(r.Body, maxRequestContentLength)
+	codec := NewJSONCodec(&httpReadWriteNopCloser{body, w})
 	defer codec.Close()
 
 	w.Header().Set("content-type", contentType)