--- parser3/src/targets/cgi/parser3.C	2026/10/16 13:55:16	1.379
+++ parser3/src/targets/cgi/parser3.C	2026/10/26 19:56:21	1.384
@@ -5,7 +5,7 @@
 	Authors: Konstantin Morshnev <moko@design.ru>, Alexandr Petrosian <paf@design.ru>
 */
 
-volatile const char * IDENT_PARSER3_C="$Id: parser3.C,v 1.379 2026/10/16 13:55:16 moko Exp $";
+volatile const char * IDENT_PARSER3_C="$Id: parser3.C,v 1.384 2026/10/26 19:56:21 moko Exp $";
 
 #include "pa_config_includes.h"
 
@@ -71,7 +71,7 @@ const char *parser3_log_filespec() { //
 	const char* slog=log_filespec;
 
 	if(!slog) {
-		static char log_spec[MAX_STRING + 12 /* '/parser3.log' */];
+		static THREAD_LOCAL char log_spec[MAX_STRING + 12 /* '/parser3.log' */];
 		pa_strncpy(log_spec, filespec_4log, MAX_STRING);
 
 		if(char* log_dir_pos=strrchr(log_spec, '/')){
@@ -100,14 +100,20 @@ static void pa_log(const char* fmt, va_l
 
 	// prefix
 	time_t t=time(0);
-	if(const char* stamp=ctime(&t)) { // never saw that
+#ifdef _MSC_VER
+	const char* stamp=ctime(&t); // the buffer is per thread
+#else
+	char stamp_buffer[32];       // the buffer of ctime() is shared by the threads
+	const char* stamp=ctime_r(&t, stamp_buffer);
+#endif
+	if(stamp) { // never saw that
 		if(size_t len=strlen(stamp)) // saw once stamp being =""
 			fprintf(f, "[%.*s] [%u] ", (int)len-1, stamp, (unsigned int)pa_get_thread_id() );
 	}
 
 	// message
 	char buf[MAX_LOG_STRING];
-	size_t size=vsnprintf(buf, MAX_LOG_STRING, fmt, args);
+	size_t size=pa_vsnprintf(buf, MAX_LOG_STRING, fmt, args);
 	size=remove_crlf(buf, buf+size);
 	fwrite(buf, size, 1, f);
 
@@ -148,7 +154,7 @@ void SAPI::die(const char* fmt, ...) {
 	// inform user, second vsnprintf
 	va_start(args, fmt);
 	char message[MAX_STRING];
-	vsnprintf(message, MAX_STRING, fmt, args);
+	pa_vsnprintf(message, MAX_STRING, fmt, args);
 
 	SAPI::send_error(sapi_info_4log ? *sapi_info_4log : *sapi_info, message);
 	exit(1);
@@ -376,6 +382,8 @@ DWORD WINAPI connection_thread(void *arg
 #else
 static void *connection_thread(void *arg){
 #endif
+	Temp_gc_references gc_references; // for pointers GC does not see, the very start of the thread
+
 	HTTPD_Connection &connection=*(HTTPD_Connection*)arg;
 	SAPI_Info_HTTPD info(connection);
 
@@ -389,6 +397,22 @@ static void *connection_thread(void *arg
 	return 0;
 }
 
+static void reject_connection(HTTPD_Connection &connection) {
+	// main thread only
+	static unsigned long total=0;
+	static time_t logged=0;
+
+	total++;
+	time_t now=time(0);
+	if(now!=logged){ // not more than once a second
+		logged=now;
+		pa_log("max-connections limit %d reached, rejecting connection from %s (%lu rejected in total)", HTTPD_Server::max_connections, connection.remote_addr, total);
+	}
+
+	SAPI_Info_HTTPD info(connection);
+	SAPI::send_error(info, "too many connections", "503");
+}
+
 static void httpd_mode() {
 	config_handler(*sapi_info);
 
@@ -401,20 +425,29 @@ static void httpd_mode() {
 	while(1){
 #ifndef _MSC_VER
 		pid_t pid=1;
-		if(HTTPD_Server::mode == HTTPD_Server::PARALLEL)
-			while (waitpid((pid_t)(-1), 0, WNOHANG) > 0);
 #endif
 		try {
 			HTTPD_Connection connection;
-			if(!connection.accept(sock, 500))
+			bool accepted=connection.accept(sock, 500);
+#ifndef _MSC_VER
+			if(HTTPD_Server::mode == HTTPD_Server::PARALLEL)
+				while (waitpid((pid_t)(-1), 0, WNOHANG) > 0)
+					HTTPD_Server::track_connection(-1); // the child has exited, some of them while we were waiting
+#endif
+			if(!accepted)
 				continue;
 
+			if(HTTPD_Server::too_many_connections()){
+				reject_connection(connection); // no thread or process is started
+				continue;
+			}
+
 			switch (HTTPD_Server::mode) {
 				case HTTPD_Server::MULTITHREADED:
 #ifdef _MSC_VER
 					if (!GC_CreateThread(0, 0, connection_thread, new HTTPD_Connection(connection), 0, 0))
 						throw Exception("httpd.fork", 0, "thread creation failed");
-					connection.sock=INVALID_SOCKET;
+					connection.sock=INVALID_SOCKET; // thread owns the connection now
 					break;
 #else
 #ifdef HAVE_TLS
@@ -425,22 +458,25 @@ static void httpd_mode() {
 
 					if(int result=GC_pthread_create(&thread, &attr, connection_thread, new HTTPD_Connection(connection)))
 						throw Exception("httpd.fork", 0, "thread creation failed (%d)", result);
-					connection.sock=INVALID_SOCKET;
+					connection.sock=INVALID_SOCKET; // thread owns the connection now
 					break;
 #endif
 				case HTTPD_Server::PARALLEL:
 					pid=fork();
 					if(pid<0)
 						throw Exception("httpd.fork", 0, "fork failed: %s (%d)", strerror(errno), errno);
-					if(pid>0)
-						continue; // parent should close connection.sock as well
+					if(pid>0){
+						closesocket(connection.sock);   // parent should close connection.sock as well
+						connection.sock=INVALID_SOCKET; // child owns the connection now
+						continue;
+					}
 #endif
 				case HTTPD_Server::SEQUENTIAL: // and fork child
 
 					SAPI_Info_HTTPD info(connection);
 					connection_handler(info, connection);
 			}
-			// closing connection socket in HTTPD_Connection destructor
+			// SEQUENTIAL or error: closing connection socket in HTTPD_Connection destructor
 		} catch(const Exception& e) { // exception in accept or send_error
 			pa_log("%s", e.comment());
 		}
@@ -618,6 +654,8 @@ static void usage(const char* message=NU
 	}
 
 int main(int argc, char *argv[]) {
+	Temp_gc_references gc_references; // for pointers GC does not see
+
 #ifdef PA_DEBUG_CGI_ENTRY_EXIT
 	pa_log("main: entry");
 #endif