diff --git a/src/go/internal/gcimporter/gcimporter.go b/src/go/internal/gcimporter/gcimporter.go
index 2140a9f98c..0b784de584 100644
--- a/src/go/internal/gcimporter/gcimporter.go
+++ b/src/go/internal/gcimporter/gcimporter.go
@@ -13,6 +13,7 @@ import (
 	"go/token"
 	"go/types"
 	"internal/pkgbits"
+	"internal/saferio"
 	"io"
 	"os"
 	"os/exec"
@@ -204,6 +205,7 @@ func Import(fset *token.FileSet, packages map[string]*types.Package, path, srcDi
 		if exportFormat, err = buf.ReadByte(); err != nil {
 			return
 		}
+		size--
 
 		// The unified export format starts with a 'u'; the indexed export
 		// format starts with an 'i'; and the older binary export format
@@ -214,9 +216,10 @@ func Import(fset *token.FileSet, packages map[string]*types.Package, path, srcDi
 			var data []byte
 			var r io.Reader = buf
 			if size >= 0 {
-				r = io.LimitReader(r, int64(size))
-			}
-			if data, err = io.ReadAll(r); err != nil {
+				if data, err = saferio.ReadData(r, uint64(size)); err != nil {
+					return
+				}
+			} else if data, err = io.ReadAll(r); err != nil {
 				return
 			}
 			s := string(data)