Index: container/catalina/src/share/org/apache/catalina/connector/InputBuffer.java
===================================================================
--- container/catalina/src/share/org/apache/catalina/connector/InputBuffer.java	(Revision 652071)
+++ container/catalina/src/share/org/apache/catalina/connector/InputBuffer.java	(Arbeitskopie)
@@ -319,8 +319,11 @@
             cb.setOffset(0);
             cb.setEnd(0);
         }
+        int limit = bb.getLength()+cb.getStart();
+        if ( cb.getLimit() < limit )
+            cb.setLimit(limit);
         state = CHAR_STATE;
-        conv.convert(bb, cb, len);
+        conv.convert(bb, cb, bb.getLength());
         bb.setOffset(bb.getEnd());
 
         return cb.getLength();
@@ -403,11 +406,7 @@
                 cb.setOffset(0);
             }
         }
-        int offset = readAheadLimit;
-        if (offset < size) {
-            offset = size;
-        }
-        cb.setLimit(cb.getStart() + offset);
+        cb.setLimit(cb.getStart() + readAheadLimit + size);
         markPos = cb.getStart();
     }