[Json] Garbage data when writing (U)Int128 as property name

[RealityProgrammer]

Description

When writing (U)Int128 as property name, the writer were fed with an unsliced stackalloc buffer after formatting the number:

https://github.com/dotnet/runtime/blob/5ebfca2bb9b9c33e4a6e4db0ed2d11591f70d2b6/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Value/Int128Converter.cs#L72C9-L77C10

Reproduction Steps

Using this code with .NET 9.0, the converter should returns as type (U)Int128Converter

using System;
using System.Text.Json;

var dict = new Dictionary<UInt128, string>() {
    [0] = "Zero",
};

Console.WriteLine(JsonSerializer.Serialize(dict));

Expected behavior

The expected written json should be

{"0":"Zero"}

Actual behavior

The json

{"0\uFFFD\uFFFD\u0000\u0014\uFFFD\uFFFD\u0000\uFFFD\uFFFD\u001B\u000B\bpD\f\uFFFDl4\u0003\uFFFDn4\u0003\u0000\u0000\u0000\u0000\uFFFDn4\u0003@\uFFFDO\u0006\uFFFDl4":"Zero"}

was returned, and the escaping can be different every time code is ran, which mean garbage data were written.

Regression?

No response

Known Workarounds

No work around for this.

Configuration

System.Text.Json 9.0.x

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-text-json, @gregsdennis
See info in area-owners.md if you want to be subscribed.

[PranavSenthilnathan]

The buffer here needs to be sliced before writing:

runtime/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Value/UInt128Converter.cs

Lines 74 to 76 in 8dbc826

	Span<byte> buffer = stackalloc byte[MaxFormatLength];
	Format(buffer, value, out int written);
	writer.WritePropertyName(buffer);

[eiriktsarpalis]

As a temporary workaround, you could try writing a custom converter for (U)Int128 that overrides the WriteAsPropertyName method.