Lighttpd

There is a bug in request.c line 577:

573     /* check if we have read post data */
574     if (con->request.content_length != -1) {
575         /* divide by 1024 as srvconf.max_request_size is in kBytes */
576         if (srv->srvconf.max_request_size != 0 &&
577             ((size_t)(con->request.content_length >> 10)) > srv->srvconf.max_request_size) {
578             /* the request body itself is larger then
579              * our our max_request_size
580              */
581 
582             con->http_status = 413;
583             con->keep_alive = 0;
584 

if server.max-request-size = 1, client sends a post request with content-length: 1300 (>1024) , it will pass.

I think the condition should be "con->request.content_length > (srv->srvconf.max_request_size << 10)"