After reading this, I checked the code. I saw a bunch of malloc calls not checked to see if the allocation failed. I don’t think it’s as obviously bulletproof as you do.
Additionally, the author isn't engaging on this site in good faith. See this thread https://news.ycombinator.com/item?id=50181138 from yesterday, where egregious vulnerabilities in this project were pointed out, at which point the author force pushed to hide the history, failed to fix the vulnerabilities pointed out (e.g. https://github.com/Qbix/proxy/blob/5a9f8a96f4bdaaaa5444b6986... still doesn't match the PHP multipart parser, so the whole defense can be mooted by switching to a space as the delimiter). This is an exemplar of slop.