on main help sign in
Merge pull request #268 from charmbracelet/charm-421

fix(non-interactive): check bounds when reading message bytes

commitcc4a43f64a0ef15b980f1e72725596bfa96eebf9 authorKujtim Hoxha <kujtimii.h@gmail.com> dateThu 24 Jul 2025, 09:22 (1 year ago) parent809477b441c28e
1 file changed+8−4
internal/app/app.go+8−4
internal/app/app.go+8−4
@@ -157,16 +157,20 @@ func (app *App) RunNonInteractive(ctx context.Context, prompt string, quiet bool
157157
158158 if result.Error != nil {
159159 if errors.Is(result.Error, context.Canceled) || errors.Is(result.Error, agent.ErrRequestCancelled) {
160− slog.Info("Agent processing cancelled", "session_id", sess.ID)
160+ slog.Info("Non-interactive: agent processing cancelled", "session_id", sess.ID)
161161 return nil
162162 }
163163 return fmt.Errorf("agent processing failed: %w", result.Error)
164164 }
165165
166− part := result.Message.Content().String()[readBts:]
167− fmt.Println(part)
166+ msgContent := result.Message.Content().String()
167+ if len(msgContent) < readBts {
168+ slog.Error("Non-interactive: message content is shorter than read bytes", "message_length", len(msgContent), "read_bytes", readBts)
169+ return fmt.Errorf("message content is shorter than read bytes: %d < %d", len(msgContent), readBts)
170+ }
171+ fmt.Println(msgContent[readBts:])
168172
169− slog.Info("Non-interactive run completed", "session_id", sess.ID)
173+ slog.Info("Non-interactive: run completed", "session_id", sess.ID)
170174 return nil
171175
172176 case event := <-messageEvents: