DataContractJsonSerializer.ReadObject throws ArgumentOutOfRangeException

[Metalnem]

DataContractJsonSerializer.ReadObject sometimes throws ArgumentOutOfRangeException. Here's the full program that reproduces this:

using System;
using System.IO;
using System.Runtime.Serialization;
using System.Runtime.Serialization.Json;
using System.Text;

namespace CoreFX.Fuzz
{
  public class Program
  {
    [DataContract]
    private class Obj
    {
      [DataMember] public DateTime X = DateTime.MinValue;
    }

    public static void Main(string[] args)
    {
      var json = @"{""X"":""\/Date()\/""}";
      var bytes = Encoding.UTF8.GetBytes(json);
      var stream = new MemoryStream(bytes);
      var serializer = new DataContractJsonSerializer(typeof(Obj));

      serializer.ReadObject(stream);
    }
  }
}

The stack trace:

Exception has occurred: CLR/System.ArgumentOutOfRangeException
An unhandled exception of type 'System.ArgumentOutOfRangeException' occurred in System.Private.CoreLib.dll: 'Index was out of range. Must be non-negative and less than the size of the collection.'
   at System.String.IndexOf(Char value, Int32 startIndex, Int32 count)
   at System.Runtime.Serialization.Json.JsonReaderDelegator.ParseJsonDateInDefaultFormat(String originalDateTimeValue)
   at System.Runtime.Serialization.Json.JsonReaderDelegator.ParseJsonDate(String originalDateTimeValue, DateTimeFormat dateTimeFormat)
   at System.Runtime.Serialization.Json.JsonReaderDelegator.ReadElementContentAsDateTime()
   at System.Runtime.Serialization.Json.JsonClassDataContract.ReadJsonValueCore(XmlReaderDelegator jsonReader, XmlObjectSerializerReadContextComplexJson context)
   at System.Runtime.Serialization.Json.JsonDataContract.ReadJsonValue(XmlReaderDelegator jsonReader, XmlObjectSerializerReadContextComplexJson context)
   at System.Runtime.Serialization.Json.XmlObjectSerializerReadContextComplexJson.ReadDataContractValue(DataContract dataContract, XmlReaderDelegator reader)
   at System.Runtime.Serialization.XmlObjectSerializerReadContext.InternalDeserialize(XmlReaderDelegator reader, String name, String ns, DataContract& dataContract)
   at System.Runtime.Serialization.XmlObjectSerializerReadContextComplex.InternalDeserialize(XmlReaderDelegator xmlReader, Type declaredType, DataContract dataContract, String name, String ns)
   at System.Runtime.Serialization.Json.DataContractJsonSerializerImpl.InternalReadObject(XmlReaderDelegator xmlReader, Boolean verifyObjectName)
   at System.Runtime.Serialization.XmlObjectSerializer.InternalReadObject(XmlReaderDelegator reader, Boolean verifyObjectName, DataContractResolver dataContractResolver)
   at System.Runtime.Serialization.XmlObjectSerializer.ReadObjectHandleExceptions(XmlReaderDelegator reader, Boolean verifyObjectName, DataContractResolver dataContractResolver)
   at System.Runtime.Serialization.Json.DataContractJsonSerializerImpl.ReadObject(XmlDictionaryReader reader)
   at System.Runtime.Serialization.Json.DataContractJsonSerializerImpl.ReadObject(Stream stream)
   at System.Runtime.Serialization.Json.DataContractJsonSerializer.ReadObject(Stream stream)

The environment:

.NET Core SDK (reflecting any global.json):
 Version:   2.2.103
 Commit:    8edbc2570a

Runtime Environment:
 OS Name:     Mac OS X
 OS Version:  10.14
 OS Platform: Darwin
 RID:         osx.10.14-x64
 Base Path:   /usr/local/share/dotnet/sdk/2.2.103/

Found via SharpFuzz.

[Lxiamail]

@Metalnem Thanks for reporting the issue. What's the real world scenario using @"{""X"":""/Date()/""}" ?

[Metalnem]

There is nothing really interesting about that particular input. I was just looking for the disrepancies between the exceptions that ReadObject should throw (SerializationException), and what it actually can throw in practice.

[jiayi11]

The ArgumentOutOfRangeExceptionexception is thrown when it tries to parse the empty datetime string. However, we decided not to fix this particular issue.
The "\/Date(...)\/" string is very specifically a .NET format of serializing DateTime to JSON. DataContractSerializer and DataContractJsonSerializer are specifically designed to work when both ends are .NET. So an empty DateTime string like "\/Date()\/" will actually not be generated during serialization which means there is no need to consume the empty datetime string.