1 files changed, 22 insertions, 25 deletions

diff --git a/src/pkg/net/http/transfer.go b/src/pkg/net/http/transfer.go
index 43c6023a3..53569bcc2 100644
--- a/src/pkg/net/http/transfer.go
+++ b/src/pkg/net/http/transfer.go
@@ -328,12 +328,13 @@ func readTransfer(msg interface{}, r *bufio.Reader) (err error) {
 	switch {
 	case chunked(t.TransferEncoding):
 		if noBodyExpected(t.RequestMethod) {
-			t.Body = &body{Reader: io.LimitReader(r, 0), closing: t.Close}
+			t.Body = &body{Reader: eofReader, closing: t.Close}
 		} else {
 			t.Body = &body{Reader: newChunkedReader(r), hdr: msg, r: r, closing: t.Close}
 		}
-	case realLength >= 0:
-		// TODO: limit the Content-Length. This is an easy DoS vector.
+	case realLength == 0:
+		t.Body = &body{Reader: eofReader, closing: t.Close}
+	case realLength > 0:
 		t.Body = &body{Reader: io.LimitReader(r, realLength), closing: t.Close}
 	default:
 		// realLength < 0, i.e. "Content-Length" not mentioned in header
@@ -342,7 +343,7 @@ func readTransfer(msg interface{}, r *bufio.Reader) (err error) {
 			t.Body = &body{Reader: r, closing: t.Close}
 		} else {
 			// Persistent connection (i.e. HTTP/1.1)
-			t.Body = &body{Reader: io.LimitReader(r, 0), closing: t.Close}
+			t.Body = &body{Reader: eofReader, closing: t.Close}
 		}
 	}
 
@@ -612,30 +613,26 @@ func (b *body) Close() error {
 	if b.closed {
 		return nil
 	}
-	defer func() {
-		b.closed = true
-	}()
-	if b.hdr == nil && b.closing {
+	var err error
+	switch {
+	case b.hdr == nil && b.closing:
 		// no trailer and closing the connection next.
 		// no point in reading to EOF.
-		return nil
-	}
-
-	// In a server request, don't continue reading from the client
-	// if we've already hit the maximum body size set by the
-	// handler. If this is set, that also means the TCP connection
-	// is about to be closed, so getting to the next HTTP request
-	// in the stream is not necessary.
-	if b.res != nil && b.res.requestBodyLimitHit {
-		return nil
-	}
-
-	// Fully consume the body, which will also lead to us reading
-	// the trailer headers after the body, if present.
-	if _, err := io.Copy(ioutil.Discard, b); err != nil {
-		return err
+	case b.res != nil && b.res.requestBodyLimitHit:
+		// In a server request, don't continue reading from the client
+		// if we've already hit the maximum body size set by the
+		// handler. If this is set, that also means the TCP connection
+		// is about to be closed, so getting to the next HTTP request
+		// in the stream is not necessary.
+	case b.Reader == eofReader:
+		// Nothing to read. No need to io.Copy from it.
+	default:
+		// Fully consume the body, which will also lead to us reading
+		// the trailer headers after the body, if present.
+		_, err = io.Copy(ioutil.Discard, b)
 	}
-	return nil
+	b.closed = true
+	return err
 }
 
 // parseContentLength trims whitespace from s and returns -1 if no value