System.Runtime.Serialization.Xml: throw SerializationException on malformed prefix

src/libraries/System.Private.DataContractSerialization/src/System/Runtime/Serialization/XmlObjectSerializer.cs

@@ -363,6 +363,10 @@ internal virtual bool InternalIsStartObject(XmlReaderDelegator reader)
             {
                 throw XmlObjectSerializer.CreateSerializationException(GetTypeInfoError(SR.ErrorDeserializing, GetDeserializeType(), ex), ex);
             }
+            catch (ArgumentException ex)
+            {
+                throw XmlObjectSerializer.CreateSerializationException(GetTypeInfoError(SR.ErrorDeserializing, GetDeserializeType(), ex), ex);
+            }
         }
 
         [RequiresDynamicCode(DataContract.SerializerAOTWarning)]
@@ -383,6 +387,10 @@ internal bool IsStartObjectHandleExceptions(XmlReaderDelegator reader)
             {
                 throw XmlObjectSerializer.CreateSerializationException(GetTypeInfoError(SR.ErrorIsStartObject, GetDeserializeType(), ex), ex);
             }
+            catch (ArgumentException ex)
+            {
+                throw XmlObjectSerializer.CreateSerializationException(GetTypeInfoError(SR.ErrorIsStartObject, GetDeserializeType(), ex), ex);
+            }
         }
 
         internal static bool IsRootXmlAny(XmlDictionaryString? rootName, DataContract contract)

src/libraries/System.Runtime.Serialization.Xml/tests/DataContractSerializer.cs

@@ -4517,6 +4517,23 @@ public static void DCS_ReadObject_XmlDictionaryReaderMaxStringContentLengthExcee
         Assert.Throws<System.Runtime.Serialization.SerializationException>(() => { dcs.ReadObject(reader); });
     }
 
+    [Fact]
+    public static void DCS_ReadObject_MalformedPrefix_EmptyLocalName_ThrowsSerializationException()
+    {
+        // Regression for https://github.com/dotnet/runtime/issues/1409
+        // Uses the original repro payload that triggers an empty local-name via an unfinished prefixed element.
+        string xml = @"<Program.Obj xmlns=""http://schemas.datacontract.org/2004/07/CoreFX.Fuzz""><s:";
+        byte[] bytes = Encoding.UTF8.GetBytes(xml);
+        using (MemoryStream stream = new MemoryStream(bytes))
+        {
+            var serializer = new DataContractSerializer(typeof(CoreFX.Fuzz.Program.Obj));
+            var ex = Assert.Throws<SerializationException>(() => serializer.ReadObject(stream));
+            Assert.NotNull(ex.InnerException);
+            Assert.IsType<ArgumentException>(ex.InnerException);
+            Assert.Equal("name", ((ArgumentException)ex.InnerException).ParamName);
+        }
+    }
+
     private static T DeserializeString<T>(string stringToDeserialize, bool shouldReportDeserializationExceptions = true, DataContractSerializerSettings settings = null, Func<DataContractSerializer> serializerFactory = null)
     {
         DataContractSerializer dcs;
@@ -4574,3 +4591,13 @@ private static void TestObjectWithDifferentPayload<T>(T value, string netcorePay
         SerializationTestTypes.ComparisonHelper.CompareRecursively(value, deserializedDesktopObject);
     }
 }
+
+// Test helper type
+namespace CoreFX.Fuzz
+{
+    public class Program
+    {
+        [DataContract]
+        public class Obj { }
+    }
+}