reject http3 responses that exceeded the header size limit

http3/roundtrip.go

@@ -46,6 +46,11 @@ type RoundTripper struct {
 	// If Dial is nil, quic.DialAddr will be used.
 	Dial func(network, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.Session, error)
 
+	// MaxResponseHeaderBytes specifies a limit on how many response bytes are
+	// allowed in the server's response header.
+	// Zero means to use a default limit.
+	MaxResponseHeaderBytes int64
+
 	clients map[string]roundTripCloser
 }
 
@@ -128,7 +133,10 @@ func (r *RoundTripper) getClient(hostname string, onlyCached bool) (http.RoundTr
 		client = newClient(
 			hostname,
 			r.TLSClientConfig,
-			&roundTripperOpts{DisableCompression: r.DisableCompression},
+			&roundTripperOpts{
+				DisableCompression: r.DisableCompression,
+				MaxHeaderBytes:     r.MaxResponseHeaderBytes,
+			},
 			r.QuicConfig,
 			r.Dial,
 		)