{"record":{"id":"8686993c2057a7e4","repo":"docker/cli","slug":"read-exceeds-the-defined-limit","errorCode":null,"errorMessage":"read exceeds the defined limit","messagePattern":"read exceeds the defined limit","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/store/io_utils.go","lineNumber":17,"sourceCode":"package store\n\nimport (\n\t\"errors\"\n\t\"io\"\n)\n\n// limitedReader is a fork of [io.LimitedReader] to override Read.\ntype limitedReader struct {\n\tR io.Reader\n\tN int64 // max bytes remaining\n}\n\n// Read is a fork of [io.LimitedReader.Read] that returns an error when limit exceeded.\nfunc (l *limitedReader) Read(p []byte) (n int, err error) {\n\tif l.N < 0 {\n\t\treturn 0, errors.New(\"read exceeds the defined limit\")\n\t}\n\tif l.N == 0 {\n\t\treturn 0, io.EOF\n\t}\n\t// have to cap N + 1 otherwise we won't hit limit err\n\tif int64(len(p)) > l.N+1 {\n\t\tp = p[0 : l.N+1]\n\t}\n\tn, err = l.R.Read(p)\n\tl.N -= int64(n)\n\treturn n, err\n}\n","sourceCodeStart":1,"sourceCodeEnd":30,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/store/io_utils.go#L1-L30","documentation":"Returned by the internal limitedReader.Read when its remaining byte counter N has gone negative, meaning more bytes were read than the configured cap. This reader wraps tar/zip import streams to enforce a maximum import size; exceeding the limit is treated as a hard error rather than silently truncating.","triggerScenarios":"Importing a docker context archive (tar or zip) larger than maxAllowedFileSizeToImport. The reader decrements N per read; once N drops below zero on a subsequent read this error fires. Triggered by 'docker context import' (or the store.Import path) on an oversized archive.","commonSituations":"A crafted or accidental context archive that exceeds the safety limit. A context export that accidentally bundled large unrelated files.","solutions":["Reduce the archive size below the import limit; remove large or unrelated files before exporting.","Re-export the context from the source to produce a minimal archive containing only meta.json and tls/ files.","Inspect the archive contents to confirm it is a legitimate context export."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Reject oversized archives before importing.\nconst maxImport = maxAllowedFileSizeToImport\nif size, err := archiveSize(path); err == nil && size > maxImport {\n    return fmt.Errorf(\"archive %d bytes exceeds import limit %d\", size, maxImport)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Re-export contexts to produce minimal archives.","Exclude unrelated files before exporting.","Check archive size before invoking import."],"tags":["context","import","size-limit","security","io"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}