Harden multi-threaded http server

[SirTyson]

Description

Fixes bug where malformed HTTP headers would crash the multithreaded HTTP server.

Checklist

• Reviewed the contributing document
• Rebased on top of master (no merge commits)
• Ran clang-format v8.0.0 (via make format or the Visual Studio extension)
• Compiles
• Ran all tests
• If change impacts performance, include supporting evidence per the performance document

[Copilot]

Pull request overview

This PR addresses a crash vulnerability in the multi-threaded HTTP server by adding exception handling around the stoi call when parsing the Content-Length header. The fix prevents malformed HTTP headers (e.g., non-numeric Content-Length values) from crashing the server.

Changes:

• Added try-catch block around stoi conversion of Content-Length header value to handle parsing exceptions

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[Copilot]

stoull(header.value) will parse prefixes like "5abc" without throwing, so malformed Content-Length headers may be accepted. Consider validating full consumption (use the pos overload and reject any non-whitespace trailing characters) to avoid inconsistent parsing (including potential request-smuggling issues).

[Copilot]

body_content_length_ is a size_t, but stoull returns unsigned long long; on 32-bit builds a large Content-Length can successfully parse yet truncate when assigned to size_t. Consider parsing into a wider temp, rejecting values > std::numeric_limits<size_t>::max() before assigning, and returning bad on overflow.

[marta-lokhova]

lgtm, but can we ask claude for a quick unit test that repros the issue and confirms the fix?