introduce query rows limit to avoid OOM

autoload/db.vim

@@ -169,8 +169,22 @@ function! s:vim_job_close_cb(state, channel) abort
 endfunction
 
 function! s:nvim_job_callback(lines, job_id, data, event) dict abort
-  let a:lines[-1] .= a:data[0]
-  call extend(a:lines, a:data[1:])
+  if len(a:lines) < g:db_query_rows_limit
+    let a:lines[-1] .= a:data[0]
+    call extend(a:lines, a:data[1:])
+  else
+    " remove the last line that was written.
+    " since we're killing the process, it could have been stopped in the
+    " middle of a line. I have seen the case that it was stopped in the middle
+    " of a multibyte unicode glyph, resulting in invalid utf8 for the file,
+    " causing a fallback to latin1 encoding in vim and bad display.
+    " side-effect: this could be called multiple times as killing the process
+    " won't be instantaneous, this ensures the 'query aborted' message is
+    " printed only once.
+    call remove(a:lines, -1)
+    call extend(a:lines, ['Query aborted: it exceeded the rows limit'])
+    call s:job_stop(a:job_id)
+  endif
 endfunction
 
 function! s:job_run(cmd, on_finish, in_file) abort

doc/dadbod.txt

@@ -214,5 +214,13 @@ the following variable to enable an experimental mode where dbext's
 configuration always mirrors Dadbod's default.
 >
   let g:dadbod_manage_dbext = 1
+<
+QUERY ROWS LIMIT                                *g:db_query_rows_limit*
+
+In order to avoid out of memory when querying vast amounts of data from the
+database, dadbod will cancel queries exceeding the maximum number of rows that
+you set up in this variable. The default is 10,000 rows.
+>
+  let g:db_query_rows_limit= 10000
 <
  vim:tw=78:et:ft=help:norl:

plugin/dadbod.vim

@@ -8,6 +8,8 @@ if exists('g:loaded_dadbod') || &cp || v:version < 704
 endif
 let g:loaded_dadbod = 1
 
+let g:db_query_rows_limit = get(g:, 'db_query_rows_limit', 10000)
+
 call extend(g:, {'db_adapters': {}}, 'keep')
 
 call extend(g:db_adapters, {