From the docs (see Avoiding Denial of Service Attacks):

  $uploaded_file = param('upload');
   if (!$uploaded_file && cgi_error()) {
      print header(-status=>cgi_error());  # <== change this line
      exit 0;
   }
[download]

Thanks for responding... After a bit more testing I have found that my script is getting control, but with an empty parameter set as expected. I am able to retrieve the cgi_error "413 Request entity too large" from cgi_error but am finding that I cannot post an html msg to the user. I seem to be falling right through the code that puts out that error msg, produce the "page cannot be displayed" error, but am able to subsequently send myself an email with the 413 error. I believe the code that puts out the html error msg is good - am using it for other errors.

You should probably try to reduce it to the minimum case, like fglock's sample from CGI.pm, that works and then expand it back to the code you're currently trying to use.

Make sure you're doing the printing of the server headers yourself with header() and that you're including your own status which you might need to do as "200 OK" to appease Apache and print your own HTML instead of the default ErrorDocument for 413.

Well, your code (the header/error part of it) ran properly for me. Here is a slightly more explicit version you might try on your own server. I'm running Apache 2.

use warnings;
use strict;
use CGI qw(:standard);
$CGI::POST_MAX = 2_000;  # play nice

my $uploaded_file = param('upload');

if ( not $uploaded_file and cgi_error() ) {
    print
        header(-status=>'200 OK'), # this might help, or not...
        start_html(-title=>'TOO BIG'),
        h2("Why are you disrespecting me with that file size?");
}
else
{
    print
        header(),
        start_html(-title=>'Just right!'),
        h2("I'm Okay, You're not so bad.");
}

print
    start_multipart_form(),
    filefield(-name=>'upload'),
    submit('Upload'),
    end_form(),
    end_html();
[download]

thanks for the script. I ran this on my system and get "Page cannot be Displayed" when I specify a file larger than post_max. Same behavior as my script.

So I just resort to using the CONTENT_LENGTH

my $maxsize = 1024 * 100; #max 100K 
my $upload_dir='uploads';
my $q = new CGI;
print $q->header();

if($ENV{CONTENT_LENGTH} > $maxsize){
 print "file too large - must be less than $maxsize bytes";
 exit;
 }
[download]

I've been able to do that OK. But the problem is CGI must download to a temp file on your server before passing control to your script, exposing you to denial of service attacks. If I can't trap it via cgi_error my server is at risk. The interesting thing about this is that I can still execute code to send myself an email after trying to put out the html msg to the user. It looks like CGI is somehow disconnecting from the process. I've tried reinstantiating CGI after getting the error but still no luck.

Uh, okay, errr... maybe try...?

#!...perl -T
use strict;
eval {
    # entire script as before but try 'require CGI' instead of 'use'
};
deal_with_problem($@) if $@;
sub deal_with_problem {
    # mail, print feedback page, etc
}
[download]