Welcome in the wcf world.... that's why i don t use it anymore, because you have so much surprise in production when you don t know the size of what you will receive...
look in option in the binding ,
you have maxReceivedMessageSize,maxBufferSize,maxBufferPoolSize,readerQuotas to set,
here is an example :
<basichttpbinding>
<binding name="basicHttp" allowcookies="true">
maxReceivedMessageSize="10000000"
maxBufferSize="10000000"
maxBufferPoolSize="10000000"
<readerquotas maxdepth="32">
maxArrayLength="100000000"
maxStringContentLength="100000000"
</readerquotas></binding>
</basichttpbinding>