I did some research and the standard imposes no limits to the size of each header field name or value. Other projects go about setting at least 8Kb per header file. (Apache HTTP Server https://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize, nginx 4-8Kb).

Filenames usually can't be larger than 255 bytes, but I suggest we either change to hdrval[8190] or allow for arbitrary size headers and use resp_header_strdup instead of resp_header_copy.

I foun out that command line like this:
wget -N --debug --content-disposition --restrict-file-names=nocontrol http://data.mos.ru/datasets/download/499

saves file with "bad" file name - "499" dispite of there is Content-Disposition filename in HTTP header. The reason is that filename is rather long and there is limit size for header value - it is hard coded in http.c:1547

---
char hdrval[256];
---

Situation may be reproduced by including in responce header linelike this:

---
Content-Disposition: attachment; filename="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
---

All value in this case (starting with "attachment") is 280 bytes long.


I didn't find standard limit for values in header, but as I understood there is limit for all header (8-48Kb).