ngx.req.discard_body() cause core dump

lua code as follow: (openresty-1.9.15.1)
local method = ngx.req.get_method()
if method == "POST" then
ngx.req.discard_body()
ngx.req.clear_header("Content-Length")
end

Some times, when the size of request body is bigger than 4096, worker process possibly core dump.

reason:

ngx_http_request_body.c -> ngx_http_read_discarded_request_body(ngx_http_request_t *r)
665: u_char buffer[NGX_HTTP_DISCARD_BUFFER_SIZE]; //4096

As ngx.req.discard_body() is asynchronous, it returns immediately. Then ngx.req.clear_header("Content-Length") will set r->headers_in.content_length_n be -1. When the follow body be recv,

684: size = (size_t) ngx_min(r->headers_in.content_length_n, NGX_HTTP_DISCARD_BUFFER_SIZE);

size will be assigned -1. However,

687: n = r->connection->recv(r->connection, buffer, size);

in this function, size will be converted to big number. If the body is bigger than 4096, stack overflow.

Start with ngx_http_request_body.c, especially ngx_http_read_discarded_request_body(), and reproduce the issue using the ngx.req.discard_body() and ngx.req.clear_header("Content-Length") sequence from the report. Verify behavior with a request body larger than 4096 bytes; done means the worker no longer core dumps in this case.