Skip to content

fix(cli): readStdin uses string.length instead of byte length for size limits #23417

Closed

Description

@GoBeromsu

Bug

readStdin() in packages/cli/src/utils/readStdin.ts defines the stdin size limit as 8 * 1024 * 1024 (8 MB in bytes), but enforces it using string.length after process.stdin.setEncoding('utf8').

Root cause

process.stdin.setEncoding('utf8');

if (totalSize + chunk.length > MAX_STDIN_SIZE) {
  const remainingSize = MAX_STDIN_SIZE - totalSize;
  data += chunk.slice(0, remainingSize);
}
  • string.length counts UTF-16 code units, not UTF-8 bytes
  • multi-byte characters (e.g., CJK, emoji) are undercounted
  • string.slice() may split surrogate pairs, producing malformed output

Impact

  • The 8 MB limit is not byte-accurate for non-ASCII input
  • Truncation may corrupt characters at the boundary

Suggested fix

Scope

This issue applies to:

  • packages/cli/src/utils/readStdin.ts

Note:
readStdinLines.ts was addressed separately in PR #23414.

Activity

  1. added
    status/need-triageIssues that need to be triaged by the triage automation.
    area/coreIssues related to User Interface, OS Support, Core Functionality
    on Mar 22, 2026
  2. gemini-cli commented on Mar 23, 2026

    @gemini-cli
    Contributor

    Found possible duplicate issues:

    If you believe this is not a duplicate, please remove the status/possible-duplicate label.

  3. GoBeromsu commented on Mar 23, 2026

    @GoBeromsu
    Author

    Found possible duplicate issues:

    If you believe this is not a duplicate, please remove the status/possible-duplicate label.

    Clarification: this is not a duplicate.

    I previously opened #23537 for the same root cause, and merged it into this issue (#23417) to keep tracking in one place. #23537 is now closed as part of that consolidation.

    Additionally:

    I’ve updated the issue description accordingly and will follow up with a PR.

  4. added theissue type on Apr 21, 2026
  5. added
    help wantedWe will accept PRs from all issues marked as "help wanted". Thanks for your support!
    and removed
    status/need-triageIssues that need to be triaged by the triage automation.
    on Apr 27, 2026
  6. devr0306 commented on Apr 27, 2026

    @devr0306
    Contributor

    Triage Summary

    @GoBeromsu, thank you for identifying this byte-accuracy bug in readStdin. Since you've indicated you're working on a PR to align it with the readStdinLines fix, I've marked this as help wanted.

  7. removed
    help wantedWe will accept PRs from all issues marked as "help wanted". Thanks for your support!
    on Apr 27, 2026
  8. self-assigned this
    on Apr 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area/coreIssues related to User Interface, OS Support, Core Functionalitytype/bug

Type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions