From 7ec7005d1e91b5b85523dbfb5d0858ece6b2114f Mon Sep 17 00:00:00 2001
From: Nate Barbettini <nathanaelb@gmail.com>
Date: Tue, 17 May 2016 12:06:16 -0700
Subject: [PATCH] Harden cookie parsing logic

---
 .../Internal/CookieParser.cs                  | 22 ++++++++++++++-----
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/src/Stormpath.Owin.Middleware/Internal/CookieParser.cs b/src/Stormpath.Owin.Middleware/Internal/CookieParser.cs
index 080bb9f..7d1ba8d 100644
--- a/src/Stormpath.Owin.Middleware/Internal/CookieParser.cs
+++ b/src/Stormpath.Owin.Middleware/Internal/CookieParser.cs
@@ -69,12 +69,22 @@ private static void ParseDelimited(string text, char[] delimiters, Action<string
                     {
                         ++scanIndex;
                     }
-                    var name = text.Substring(scanIndex, equalIndex - scanIndex);
-                    var value = text.Substring(equalIndex + 1, delimiterIndex - equalIndex - 1);
-                    callback(
-                        Uri.UnescapeDataString(name),
-                        Uri.UnescapeDataString(value),
-                        state);
+
+                    try
+                    {
+                        var name = text.Substring(scanIndex, equalIndex - scanIndex);
+                        var value = text.Substring(equalIndex + 1, delimiterIndex - equalIndex - 1);
+                        callback(
+                            Uri.UnescapeDataString(name),
+                            Uri.UnescapeDataString(value),
+                            state);
+                    }
+                    catch (ArgumentOutOfRangeException)
+                    {
+                        // bad cookie data
+                        // todo log
+                    }
+
                     equalIndex = text.IndexOf('=', equalIndex + 1);
                     if (equalIndex == -1)
                     {