Pound forwards chunk sizes prefixed with 0x, -, and +

[kenballus]

Because Pound parses chunk sizes using strtoll(, , 16), chunk sizes that begin with 0x are erroneously accepted and forwarded. - and + prefixes are also accepted for the same reason, though - is only accepted when the chunk size is 0. This is not permitted in the HTTP RFCs, and can lead to problems for downstream servers because some servers interpret chunk sizes that begin with 0x as equivalent to 0. This can be used for request smuggling against such servers.

[graygnuorg]

Thanks for reporting. Fixed by 60a4f42 and f70db92.