Merge pull request #28048 from Anipik/branding2.1

Update branding to 2.1.20

Author: Anipik

dependencies.props

@@ -12,7 +12,7 @@
 
   <PropertyGroup>
     <!-- Central place to set the versions of all nuget packages produced in the repo -->
-    <PackageVersion Condition="'$(PackageVersion)' == ''">2.1.19</PackageVersion>
+    <PackageVersion Condition="'$(PackageVersion)' == ''">2.1.20</PackageVersion>
 
     <!-- Set the boolean below to true to generate packages with stabilized versions -->
     <StabilizePackageVersion Condition="'$(StabilizePackageVersion)' == ''">false</StabilizePackageVersion>

src/mscorlib/src/System/IO/BinaryReader.cs

@@ -312,8 +312,11 @@ public virtual String ReadString()
                 if (currPos == 0 && n == stringLength)
                     return new String(_charBuffer, 0, charsRead);
 
+                // Since we could be reading from an untrusted data source, limit the initial size of the
+                // StringBuilder instance we're about to get or create. It'll expand automatically as needed.
+
                 if (sb == null)
-                    sb = StringBuilderCache.Acquire(stringLength); // Actual string length in chars may be smaller.
+                    sb = StringBuilderCache.Acquire(Math.Min(stringLength, StringBuilderCache.MAX_BUILDER_SIZE)); // Actual string length in chars may be smaller.
                 sb.Append(_charBuffer, 0, charsRead);
                 currPos += n;
             } while (currPos < stringLength);

src/mscorlib/src/System/Text/StringBuilderCache.cs

@@ -41,7 +41,7 @@ internal static class StringBuilderCache
         // The value 360 was chosen in discussion with performance experts as a compromise between using
         // as litle memory (per thread) as possible and still covering a large part of short-lived
         // StringBuilder creations on the startup path of VS designers.
-        private const int MAX_BUILDER_SIZE = 360;
+        internal const int MAX_BUILDER_SIZE = 360;
 
         [ThreadStatic]
         private static StringBuilder CachedInstance;