From 6d4db72d6d83ad1001fb71fd14170cb7e43eee25 Mon Sep 17 00:00:00 2001
From: giorka <144945713+giorka@users.noreply.github.com>
Date: Tue, 19 May 2026 15:58:21 +0300
Subject: [PATCH] feat(tdnet/HttpReader): Add form_data_skipped_length_ limit
 check

---
 tdnet/td/net/HttpReader.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tdnet/td/net/HttpReader.cpp b/tdnet/td/net/HttpReader.cpp
index 0259f172c19b..87eaf78c85dc 100644
--- a/tdnet/td/net/HttpReader.cpp
+++ b/tdnet/td/net/HttpReader.cpp
@@ -525,7 +525,9 @@ Result<bool> HttpReader::parse_multipart_form_data(bool can_be_slow) {
         LOG(DEBUG) << "Skipping epilogue. Have " << size << " bytes";
         content_->advance(size);
         form_data_skipped_length_ += size;
-        // TODO(now): check if form_data_skipped_length is too big
+        if (form_data_skipped_length_ > MAX_CONTENT_SIZE) {
+          return Status::Error(413, "Request Entity Too Large: multipart/form-data is too big");
+        }
         return flow_sink_.is_ready();
       }
       default: