Convert.ToBase64CharArray throws IndexOutOfRangeException when encoding a zero-length slice of a non-empty source array into the zero-length slice at the end of a destination array

[Stevie-O]

While writing a wrapper for Convert.ToBase64String to support Base64Url-encoding (slightly different character set, no padding), I encountered this bug:

var bytes = new byte[1];
var chars = new char[0];
Convert.ToBase64CharArray(bytes, 0, 0, chars, 0, Base64FormattingOptions.None).Dump(); // throws IndexOutOfRangeException

(The bug also exists in FX -- in fact, I encountered it there first.)

runtime/src/libraries/System.Private.CoreLib/src/System/Convert.cs

Line 2400 in 3eddabc

if (inArrayLength == 0)

The issue is that the referenced line is trying to check for a zero-length conversion, but instead of checking length (the number of input bytes to be converted) it checks inArrayLength (the length of the array that the input bytes come from). As a result, if the source array itself has nonzero length, the check fails and the remainder of the method continues executing.

In such instances, this line of code:

runtime/src/libraries/System.Private.CoreLib/src/System/Convert.cs

Line 2418 in 3eddabc

fixed (char* outChars = &outArray[offsetOut])

tries to take the address of outArray[offsetOut]. If offsetOut == outArray.Length (destination is the zero-length slice at the end of outArray -- which can most easily occur if outArray is the empty array and offsetOut is zero), then outArray[offsetOut] does not exist, and trying to take its address causes IndexOutOfRangeException to be thrown.

[ghost]

Tagging subscribers to this area: @dotnet/area-system-runtime
See info in area-owners.md if you want to be subscribed.

Issue Details

---

While writing a wrapper for Convert.ToBase64String to support Base64Url-encoding (slightly different character set, no padding), I encountered this bug:

var bytes = new byte[1];
var chars = new char[0];
Convert.ToBase64CharArray(bytes, 0, 0, chars, 0, Base64FormattingOptions.None).Dump(); // throws IndexOutOfRangeException

(The bug also exists in FX -- in fact, I encountered it there first.)

runtime/src/libraries/System.Private.CoreLib/src/System/Convert.cs

Line 2400 in 3eddabc

if (inArrayLength == 0)

The issue is that the referenced line is trying to check for a zero-length conversion, but instead of checking length (the number of input bytes to be converted) it checks inArrayLength (the length of the array that the input bytes come from). As a result, if the source array itself has nonzero length, the check fails and the remainder of the method continues executing.

In such instances, this line of code:

runtime/src/libraries/System.Private.CoreLib/src/System/Convert.cs

Line 2418 in 3eddabc

fixed (char* outChars = &outArray[offsetOut])

tries to take the address of outArray[offsetOut]. If offsetOut == outArray.Length (destination is the zero-length slice at the end of outArray -- which can most easily occur if outArray is the empty array and offsetOut is zero), then outArray[offsetOut] does not exist, and trying to take its address causes IndexOutOfRangeException to be thrown.

Author:	Stevie-O
Assignees:	-
Labels:	area-System.Runtime, untriaged
Milestone:	-