miantalha45 opened a new issue, #3627: URL: https://github.com/apache/fory/issues/3627
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/fory/issues) and found no similar issues. ### Version 0.17.0 ### Component(s) Other ### Minimal reproduce step Just run this test script for reproducing the issue: ```dart import 'package:fory/src/config.dart'; import 'package:fory/src/context/meta_string_reader.dart'; import 'package:fory/src/context/ref_reader.dart'; import 'package:fory/src/context/ref_writer.dart'; import 'package:fory/src/memory/buffer.dart'; import 'package:fory/src/resolver/type_resolver.dart'; import 'package:test/test.dart'; void main() { test('RefReader.readRefOrNull does not throw for an out-of-range ref id', () { final reader = RefReader(); final buffer = Buffer(); buffer.writeByte(RefWriter.refFlag); buffer.writeVarUint32(9999); bufferSetReaderIndex(buffer, 0); expect( () => reader.readRefOrNull(buffer), returnsNormally, ); }); test( 'MetaStringReader.readMetaString does not throw for a negative ref index', () { final reader = MetaStringReader(TypeResolver(const Config())); final buffer = Buffer(); buffer.writeVarUint32Small7(1); bufferSetReaderIndex(buffer, 0); expect( () => reader.readMetaString(buffer), returnsNormally, ); }); } ### What did you expect to see? I expected the Dart runtime to reject the malformed reference data cleanly, without throwing a RangeError or crashing. For the ref test, I expected readRefOrNull to handle an out-of-range ref id safely. For the meta-string test, I expected readMetaString to handle the crafted reference header safely instead of indexing -1. ### What did you see instead? The current Dart runtime throws RangeError for both cases. RefReader.readRefOrNull indexes _refs[id] directly when the ref flag is set, so a large ref id like 9999 fails with an out-of-range error. MetaStringReader.readMetaString computes length - 1 for a reference header, so header 1 becomes index -1 and fails with a RangeError. ### Anything Else? _No response_ ### Are you willing to submit a PR? - [x] I'm willing to submit a PR! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
