Merged PR 18778: Constrain the MemoryStream size

Constrain the MemoryStream size

Author: Pranav Krishnamoorthy

src/System.Web.Http.Owin/HttpMessageHandlerAdapter.cs

@@ -275,7 +275,7 @@ private static async Task<HttpContent> CreateBufferedRequestContentAsync(IOwinRe
             }
             else
             {
-                buffer = new MemoryStream(contentLength.Value);
+                buffer = new MemoryStream(Math.Min(4 * 1024, contentLength.Value));
             }
 
             cancellationToken.ThrowIfCancellationRequested();