mono/mono — pull request #579 by martinpotter (2013-03-01 00:28:10+00:00)
Title: UTF8Decoder.GetChars(Byte[], Int32, Int32, Char[], Int32, Boolean) can w...

...rite past end of char[]. Fixes Bug#10788

UTF8Decoder.GetChars(Byte[], Int32, Int32, Char[], Int32, Boolean) eventually calls into UTF8Encoding.InternalGetChars, which does not perform any bounds checking on the passed in char* until after the first byte > 0x80 is encountered. For instance:

byte[] bytes = new byte[4096];
char[] chars = new char[10];
int charactersWritten = System.Text.Encoding.UTF8.GetDecoder().GetChars(bytes,
0, 4096, chars, 9, false);

will result in no errors and charactersWritten = 4096.