Uri.TryCreate throws IndexOutOfRangeException

[Metalnem]

Uri.TryCreate is a non-throwing method, but for some inputs it can throw IndexOutOfRangeException. Here's the full program that reproduces this:

using System;
using System.Text;

namespace Test
{
  public class Program
  {
    public static void Main(string[] args)
    {
      var b = new byte[] {
        92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92,
        92, 226, 128, 174, 47, 255, 11, 117, 102, 112, 10
      };

      var s = Encoding.UTF8.GetString(b);
      Uri.TryCreate(s, UriKind.RelativeOrAbsolute, out _);
    }
  }
}

The stack trace:

Exception has occurred: CLR/System.IndexOutOfRangeException
An unhandled exception of type 'System.IndexOutOfRangeException' occurred in System.Private.Uri.dll: 'Index was outside the bounds of the array.'
   at System.Uri.CreateUriInfo(Flags cF)
   at System.Uri.EnsureUriInfo()
   at System.Uri.ParseRemaining()
   at System.Uri.EnsureParseRemaining()
   at System.Uri.InitializeUri(ParsingError err, UriKind uriKind, UriFormatException& e)
   at System.Uri.CreateHelper(String uriString, Boolean dontEscape, UriKind uriKind, UriFormatException& e)
   at System.Uri.TryCreate(String uriString, UriKind uriKind, Uri& result)

The environment:

.NET Core SDK (reflecting any global.json):
 Version:   2.2.103
 Commit:    8edbc2570a

Runtime Environment:
 OS Name:     Mac OS X
 OS Version:  10.14
 OS Platform: Darwin
 RID:         osx.10.14-x64
 Base Path:   /usr/local/share/dotnet/sdk/2.2.103/

Found via SharpFuzz.

[davidsh]

@rmkerr

[rmkerr]

Hey @Metalnem, thanks for reporting this! The decoded version of that string is \\\\\\\\\\\\\\‮/��ufp
which contains a Unicode bidirectional control character (and was incredibly difficult to get formatted correctly for this comment). With that in mind, I think this is a duplicate of #1487.

On a different note, SharpFuzz looks like a fantastic project. I'd love to get it running regularly against System.Uri.

[danmoseley]

and was incredibly difficult to get formatted correctly for this comment

😃

[davidsh]

and was incredibly difficult to get formatted correctly for this comment

In cases like that, I like pasting in screenshots.

[Metalnem]

@rmkerr Yes, it looks like the duplicate of #1487. I was searching the issues for TryCreate, which is probably why I missed it. Regarding SharpFuzz: my plan is actually to test the important parts of the .NET Core standard library, and then figure out some way to automate the tests.

[rmkerr]

Sounds great. If you run into any other URI related issues feel free to open an issue and tag me so I can take a look. The only exception would be anything potentially security related -- in that case you should hold off opening an issue, and should email secure@microsoft.com instead.