I found a way to break string.Format but I am not sure if it's a bug or user mistake

[sebas77]

Please check this sharplab.io demo:

https://sharplab.io/#v2:EYLgdgpgLgZgHgGiiATgVzAHwAICYAMAsAFB4CMJJAbgIYoAEAzlAwLz3Zn4B0AYgPYoAtjSgAKAEQBvfAF8JCehIA8AY34AbQawDuACwCWUCAD4A4luA0NIegBl+q6wYBeog/zD0NNMAHM0Gj8IegByAFF/DQNGPVD6GPohGMYDf3oaehZfRh8oDy8YQXoAawgATzDsowB9FAhU5iE0DSgamAN6mvwyGplZUIBCZQB6dS0UEwkASgBuEk5uAGFPRk0IbgB1FCMIMWYUOaA=

atm I am forced to sanitise the arg strings in my application. What's your opinion?

[HaloFour]

I would suggest opening a discussion with the runtime repository which deals with the base class libraries in .NET.

Interestingly it doesn't seem to affect .NET Core, which I believe is what "Default" uses in Sharplab.

[sebas77]

thanks I actually use Unity mono where it's reproducible too.

[HaloFour]

Oh, in that case you might want to bring it to the repository where Unity manages their fork of Mono: https://github.com/Unity-Technologies/mono

I imagine it's reproducible in Mono as well, though: https://github.com/mono/mono

[jnm2]

This is a smaller repro (SharpLab):

string.Format("{0}", "{0}" + new string('x', 98));