x/net/http2/h2c: ineffective mitigation for unsafe io.ReadAll [1.19 backport]

[gopherbot]

@neild requested issue #56352 to be considered for backport to the next 1.19 minor release.

@gopherbot please open backport issues, this is a potential request smuggling vector

[toothrot]

@neild Can you provide a little more detail in the justification on the backport? Is this a significant regression or security issue?

[neild]

@toothrot This is a (minor) security issue.

[neild]

Looking at this now, I lost track of where the fix was applied: The fix is in the golang.org/x/net/http2/h2c package, which is not vendored. No backport necessary.