@@ -434,7 +434,8 @@ apr_status_t modsecurity_request_body_to_stream(modsec_rec *msr, const char *buf
434434if (msr -> stream_input_data == NULL ) {
435435// Is the request body length is known beforehand? (requests that are not Transfer-Encoding: chunked)
436436if (msr -> request_content_length > 0 ) {
437- allocate_length = msr -> request_content_length ;
437+ // Use min of Content-Length and SecRequestBodyLimit
438+ allocate_length = min (msr -> request_content_length ,msr -> txcfg -> reqbody_limit );
438439 }
439440else {
440441// We don't know how this request is going to be, so hope for just buflen to begin with (requests that are Transfer-Encoding: chunked)
@@ -472,6 +473,9 @@ apr_status_t modsecurity_request_body_to_stream(modsec_rec *msr, const char *buf
472473"Unable to reallocate memory to hold request body on stream. Asked for %" APR_SIZE_T_FMT " bytes." ,
473474allocate_length );
474475free (msr -> stream_input_data );
476+ msr -> stream_input_data = NULL ;
477+ msr -> stream_input_length = 0 ;
478+ msr -> stream_input_allocated_length = 0 ;
475479return -1 ;
476480 }
477481 }