From a2f9acf917d06c7646fbef8488581525956bfd1b Mon Sep 17 00:00:00 2001
From: James Newton-King <james@newtonking.com>
Date: Sat, 3 Oct 2015 14:28:13 +1300
Subject: [PATCH] -Fixed potential error when writing escaped unicode character

---
 Src/Newtonsoft.Json.Tests/JsonConvertTest.cs     | 12 ++++++++++++
 Src/Newtonsoft.Json/Utilities/JavaScriptUtils.cs | 14 ++++++++------
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/Src/Newtonsoft.Json.Tests/JsonConvertTest.cs b/Src/Newtonsoft.Json.Tests/JsonConvertTest.cs
index eb2576f3..6c6a1a05 100644
--- a/Src/Newtonsoft.Json.Tests/JsonConvertTest.cs
+++ b/Src/Newtonsoft.Json.Tests/JsonConvertTest.cs
@@ -60,6 +60,18 @@ namespace Newtonsoft.Json.Tests
     [TestFixture]
     public class JsonConvertTest : TestFixtureBase
     {
+        [Test]
+        public void ToStringEnsureEscapedArrayLength()
+        {
+            const char nonAsciiChar = (char)257;
+            const char escapableNonQuoteAsciiChar = '\0';
+
+            string value = nonAsciiChar + @"\" + escapableNonQuoteAsciiChar;
+
+            string convertedValue = JsonConvert.ToString((object)value);
+            Assert.AreEqual(@"""" + nonAsciiChar + @"\\\u0000""", convertedValue);
+        }
+
         public class PopulateTestObject
         {
             public decimal Prop { get; set; }
diff --git a/Src/Newtonsoft.Json/Utilities/JavaScriptUtils.cs b/Src/Newtonsoft.Json/Utilities/JavaScriptUtils.cs
index 378db190..383d83f5 100644
--- a/Src/Newtonsoft.Json/Utilities/JavaScriptUtils.cs
+++ b/Src/Newtonsoft.Json/Utilities/JavaScriptUtils.cs
@@ -45,6 +45,8 @@ namespace Newtonsoft.Json.Utilities
         internal static readonly bool[] DoubleQuoteCharEscapeFlags = new bool[128];
         internal static readonly bool[] HtmlCharEscapeFlags = new bool[128];
 
+        private const int UnicodeTextLength = 6;
+
         static JavaScriptUtils()
         {
             IList<char> escapeChars = new List<char>
@@ -159,8 +161,8 @@ namespace Newtonsoft.Json.Utilities
                                 }
                                 else
                                 {
-                                    if (writeBuffer == null)
-                                        writeBuffer = new char[6];
+                                    if (writeBuffer == null || writeBuffer.Length < UnicodeTextLength)
+                                        writeBuffer = new char[UnicodeTextLength];
 
                                     StringUtils.ToCharAsUnicode(c, writeBuffer);
 
@@ -182,8 +184,8 @@ namespace Newtonsoft.Json.Utilities
 
                     if (i > lastWritePosition)
                     {
-                        int length = i - lastWritePosition + ((isEscapedUnicodeText) ? 6 : 0);
-                        int start = (isEscapedUnicodeText) ? 6 : 0;
+                        int length = i - lastWritePosition + ((isEscapedUnicodeText) ? UnicodeTextLength : 0);
+                        int start = (isEscapedUnicodeText) ? UnicodeTextLength : 0;
 
                         if (writeBuffer == null || writeBuffer.Length < length)
                         {
@@ -192,7 +194,7 @@ namespace Newtonsoft.Json.Utilities
                             // the unicode text is already in the buffer
                             // copy it over when creating new buffer
                             if (isEscapedUnicodeText)
-                                Array.Copy(writeBuffer, newBuffer, 6);
+                                Array.Copy(writeBuffer, newBuffer, UnicodeTextLength);
 
                             writeBuffer = newBuffer;
                         }
@@ -207,7 +209,7 @@ namespace Newtonsoft.Json.Utilities
                     if (!isEscapedUnicodeText)
                         writer.Write(escapedValue);
                     else
-                        writer.Write(writeBuffer, 0, 6);
+                        writer.Write(writeBuffer, 0, UnicodeTextLength);
                 }
 
                 if (lastWritePosition == 0)