test

This test validates the fix.

Author: NoelStephensUnity

com.unity.netcode.gameobjects/Tests/Editor/Serialization/FastBufferReaderTests.cs

@@ -924,6 +924,40 @@ public void GivenFastBufferWriterContainingValue_WhenReadingString_ValueMatchesW
             }
         }
 
+        /// <summary>
+        /// This validates that <see cref="FastBufferReader"/> catches a potential
+        /// scenario where the string's character count value has already been read
+        /// due to an error within user script and the resultant character count
+        /// multiplied times 2 (when using 2 bytes vs 1) causes the length to roll over
+        /// to a negative value which, in turn, causes the reader to attempt to read
+        /// into restricted memory and causes the editor to crash.
+        /// </summary>
+        [Test]
+        public void ReadingStringAfterStringLengthHasAlreadyBeenRead()
+        {
+            // This was an issue uncovered in UUM-145752 that resulted
+            // in the below text to result in a length that when using
+            // 2 bytes per character would cause the skewed size to roll
+            // over into a negative value causing the editor to crash
+            // when it attempted to read a large negative offset value.
+            string valueToTest = "true";
+
+            var serializedValueSize = FastBufferWriter.GetWriteSize(valueToTest);
+
+            using var writer = new FastBufferWriter(serializedValueSize + 3, Allocator.Temp);
+            writer.WriteValueSafe(valueToTest);
+
+            using var reader = new FastBufferReader(writer, Allocator.Temp);
+
+            // Read the value of the character count before trying to read the string
+            // This mocks user code having read too far into a stream causing the position to be skewed such that
+            // the string reader reads the some of the bytes for the actual text as the length.
+            reader.ReadByteSafe(out byte count);
+            Assert.True(count == valueToTest.Length, $"Count ({count}) is not the expected size of {valueToTest.Length}!");
+
+            // This should throw an overflow exception but should not crash the editor.
+            Assert.Throws<OverflowException>(() => reader.ReadValueSafe(out string valueRead));
+        }
 
         [TestCase(1, 0)]
         [TestCase(2, 0)]