[release/10.0] Fix handling of non-ASCII data in CBOR indefinite strings

[bartonjs]

Backport of #131235 to release/10.0

Customer Impact

• Customer reported
• Found internally

When reading an indefinite-length encoded text string, TryReadTextString moves the write position forward the number of bytes read, not the number of chars written, so non-ASCII data gets exceptions that a precisely-sized buffer is too small (despite having had the size pre-validated).

Regression

• Yes
• No

It seems to have had this behavior since the method was introduced, in .NET 5.

Testing

This change includes tests that exercise the pattern better, including having a non-ASCII character in something other than the final position in a string.

Risk

Low. Existing test coverage shows no regressions for pure-ASCII and Unicode-final-only, new test coverage shows Unicode-before-final works correctly.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-formats-cbor, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes CborReader.TryReadTextString handling for indefinite-length text strings containing non-ASCII UTF-8, ensuring destination slicing advances by the number of chars written (not the UTF-8 byte length). This aligns TryRead... behavior with the existing ReadTextString() concatenation logic and improves correctness for multi-byte UTF-8 chunks.

Changes:

• Fix TryReadIndefiniteLengthTextStringConcatenated to slice the destination span by chunkCharsWritten rather than the chunk’s byte length.
• Add/extend unit test coverage for non-ASCII text (e.g., “São Paulo”, “München”, Cyrillic) across ReadTextString and TryReadTextString, including additional conformance/error-path coverage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Formats.Cbor/tests/Reader/CborReaderTests.TextString.cs	Adds regression coverage for non-ASCII text and expands TryReadTextString coverage across success/failure paths.
src/libraries/System.Formats.Cbor/src/System/Formats/Cbor/Reader/CborReader.String.cs	Fixes the span-advance logic when concatenating UTF-8 chunks for indefinite-length text strings in TryRead....

[bartonjs]

/backport to release/9.0-staging

[github-actions]

Started backporting to release/9.0-staging (link to workflow run)

[github-actions]

@bartonjs backporting to release/9.0-staging was not run because the source pull request has not been merged. Please merge this pull request before requesting a backport.

[svick]

Hi,

the code complete date for 10.0.12 (the September 2026 release) is Monday 10 August. Make sure to merge this PR on that date at the latest, or it won't make it into that release.

As a reminder, if this is a product change, you also need Tactics approval before merging this PR (test-only or infra-only changes don't require Tactics approval).