Fix bounds checking in PagedCharBuffer and related code

src/Microsoft.AspNetCore.Mvc.TagHelpers/CacheTagHelper.cs

@@ -2,6 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.Diagnostics;
 using System.IO;
 using System.Text;
 using System.Text.Encodings.Web;
@@ -228,10 +229,13 @@ public void WriteTo(TextWriter writer, HtmlEncoder encoder)
 
                 for (var i = 0; i < _buffer.Pages.Count; i++)
                 {
-                    var pageLength = Math.Min(length, PagedCharBuffer.PageSize);
-                    writer.Write(_buffer.Pages[i], 0, pageLength);
+                    var page = _buffer.Pages[i];
+                    var pageLength = Math.Min(length, page.Length);
+                    writer.Write(page, index: 0, count: pageLength);
                     length -= pageLength;
                 }
+
+                Debug.Assert(length == 0);
             }
         }
     }

src/Microsoft.AspNetCore.Mvc.ViewFeatures/Internal/PagedBufferedTextWriter.cs

@@ -3,6 +3,7 @@
 
 using System;
 using System.Buffers;
+using System.Diagnostics;
 using System.IO;
 using System.Text;
 using System.Threading.Tasks;
@@ -39,15 +40,16 @@ public override async Task FlushAsync()
             for (var i = 0; i < pages.Count; i++)
             {
                 var page = pages[i];
-
-                var pageLength = Math.Min(length, PagedCharBuffer.PageSize);
+                var pageLength = Math.Min(length, page.Length);
                 if (pageLength != 0)
                 {
-                    await _inner.WriteAsync(page, 0, pageLength);
+                    await _inner.WriteAsync(page, index: 0, count: pageLength);
                 }
+
                 length -= pageLength;
             }
 
+            Debug.Assert(length == 0);
             _charBuffer.Clear();
         }
 

src/Microsoft.AspNetCore.Mvc.ViewFeatures/Internal/PagedCharBuffer.cs

@@ -26,9 +26,9 @@ public int Length
             get
             {
                 var length = _charIndex;
-                if (Pages.Count > 1)
+                for (var i = 0; i < Pages.Count - 1; i++)
                 {
-                    length += PageSize * (Pages.Count - 1);
+                    length += Pages[i].Length;
                 }
 
                 return length;
@@ -120,8 +120,7 @@ public void Clear()
 
         private char[] GetCurrentPage()
         {
-            if (CurrentPage == null ||
-                _charIndex == PageSize)
+            if (CurrentPage == null || _charIndex == CurrentPage.Length)
             {
                 CurrentPage = NewPage();
                 _charIndex = 0;

test/Microsoft.AspNetCore.Mvc.ViewFeatures.Test/Internal/PagedBufferedTextWriterTest.cs

@@ -265,6 +265,66 @@ public async Task FlushAsync_ReturnsPages()
             Assert.Equal(3, pool.Returned.Count);
         }
 
+        [Fact]
+        public async Task FlushAsync_FlushesContent()
+        {
+            // Arrange
+            var pool = new TestArrayPool();
+            var inner = new StringWriter();
+
+            var writer = new PagedBufferedTextWriter(pool, inner);
+            for (var i = 0; i < Content.Length; i++)
+            {
+                writer.Write(Content[i]);
+            }
+
+            // Act
+            await writer.FlushAsync();
+
+            // Assert
+            Assert.Equal<char>(Content, inner.ToString().ToCharArray());
+        }
+
+        [Fact]
+        public async Task FlushAsync_WritesContentToInner()
+        {
+            // Arrange
+            var pool = new TestArrayPool();
+            var inner = new StringWriter();
+
+            var writer = new PagedBufferedTextWriter(pool, inner);
+            for (var i = 0; i < Content.Length; i++)
+            {
+                writer.Write(Content[i]);
+            }
+
+            // Act
+            await writer.FlushAsync();
+
+            // Assert
+            Assert.Equal<char>(Content, inner.ToString().ToCharArray());
+        }
+
+        [Fact]
+        public async Task FlushAsync_WritesContentToInner_WithLargeArrays()
+        {
+            // Arrange
+            var pool = new RentMoreArrayPool();
+            var inner = new StringWriter();
+
+            var writer = new PagedBufferedTextWriter(pool, inner);
+            for (var i = 0; i < Content.Length; i++)
+            {
+                writer.Write(Content[i]);
+            }
+
+            // Act
+            await writer.FlushAsync();
+
+            // Assert
+            Assert.Equal<char>(Content, inner.ToString().ToCharArray());
+        }
+
         private class TestArrayPool : ArrayPool<char>
         {
             public IList<char[]> Returned { get; } = new List<char[]>();
@@ -279,5 +339,20 @@ public override void Return(char[] buffer, bool clearArray = false)
                 Returned.Add(buffer);
             }
         }
+
+        private class RentMoreArrayPool : ArrayPool<char>
+        {
+            public IList<char[]> Returned { get; } = new List<char[]>();
+
+            public override char[] Rent(int minimumLength)
+            {
+                return new char[2 * minimumLength];
+            }
+
+            public override void Return(char[] buffer, bool clearArray = false)
+            {
+                Returned.Add(buffer);
+            }
+        }
     }
-}
+}