Denial of Service in HTTP Header parser in squid proxy

A remote client or server can trigger a Denial of Service by sending oversized headers in HTTP messages. This is particularly effective if the `request_header_max_size` or `reply_header_max_size` settings are not changed from their default values in Squid versions prior to 6.5. In version 6.5 and later, the default settings are safe, but the application will still emit a warning if an administrator configures these parameters to unsafe values.

The vulnerability lies within the HTTP header parsing logic in Squid. Specifically, the configuration parameters `request_header_max_size` and `reply_header_max_size` are involved. The patch modifies the `configDoConfigure` function to include checks and warnings for these header size limits [ref_id=1].

The patch introduces checks to warn administrators if `request_header_max_size` or `reply_header_max_size` are set to values that exceed a calculated safe limit, which is approximately one-third of the maximum String size. This limit is intended to mitigate the risk of Denial of Service attacks related to oversized headers. While the warning is emitted, the application does not prevent the configuration of these unsafe values at this time [ref_id=1].