From 18cc211d0eebe8f0902dfe8d76b0055d7dac39c9 Mon Sep 17 00:00:00 2001
From: David Cobbold <david.cobbold@cibc.co.uk>
Date: Mon, 2 Jul 2018 10:13:18 +0100
Subject: [PATCH] Avoid race condition by ensuring array index is evaluated
 before accessing the array

---
 Src/Newtonsoft.Json/DefaultJsonNameTable.cs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Src/Newtonsoft.Json/DefaultJsonNameTable.cs b/Src/Newtonsoft.Json/DefaultJsonNameTable.cs
index 66865cd2..a86a610d 100644
--- a/Src/Newtonsoft.Json/DefaultJsonNameTable.cs
+++ b/Src/Newtonsoft.Json/DefaultJsonNameTable.cs
@@ -75,7 +75,11 @@ namespace Newtonsoft.Json
             hashCode -= hashCode >> 17;
             hashCode -= hashCode >> 11;
             hashCode -= hashCode >> 5;
-            for (Entry entry = _entries[hashCode & _mask]; entry != null; entry = entry.Next)
+
+			// make sure index is evaluated before accessing _entries, otherwise potential race condition causing IndexOutOfRangeException
+			var index = hashCode & _mask;
+
+	        for (Entry entry = _entries[index]; entry != null; entry = entry.Next)
             {
                 if (entry.HashCode == hashCode && TextEquals(entry.Value, key, start, length))
                 {