Perhaps the best solution would be to avoid sanity checking at all, and to instead read into a dynamically-expanding buffer. If the server really does send down

Perhaps the best solution would be to avoid sanity checking at all, and to instead read into a dynamically-expanding buffer. If the server really does send down 1.2 GB, you'll be ready for it, but a malicious attacker trying to DoS you won't do damage by sending "1GB" followed by a connection close.