Upload size is snapshotted for the SCP C directive, but later reads are not bounded to the remaining announced bytes and String length is used instead of byte length. A growing source can announce 3 bytes and send 6; a shrinking source can announce 6, send 3, then emit the success terminator.
A release-compatible correction reads at most the remaining bytes, uses bytesize, ignores growth beyond the snapshot, and aborts on early EOF, empty reads or readers returning more than requested.
Dual-Ruby models cover growth, shrink, UTF-8 byte accounting and oversized reads; the unchanged suite passes 36 tests /70 assertions on both Rubies. This is an issue-first report because the README requests regression tests while the consumer audit explicitly forbids modifying repository tests.
Upload size is snapshotted for the SCP
Cdirective, but later reads are not bounded to the remaining announced bytes and String length is used instead of byte length. A growing source can announce 3 bytes and send 6; a shrinking source can announce 6, send 3, then emit the success terminator.A release-compatible correction reads at most the remaining bytes, uses
bytesize, ignores growth beyond the snapshot, and aborts on early EOF, empty reads or readers returning more than requested.Dual-Ruby models cover growth, shrink, UTF-8 byte accounting and oversized reads; the unchanged suite passes 36 tests /70 assertions on both Rubies. This is an issue-first report because the README requests regression tests while the consumer audit explicitly forbids modifying repository tests.