Reject hostnames with unpaired UTF-16 surrogates

okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/tls/OkHostnameVerifier.kt

@@ -24,7 +24,6 @@ import javax.net.ssl.SSLException
 import javax.net.ssl.SSLSession
 import okhttp3.internal.canParseAsIpAddress
 import okhttp3.internal.toCanonicalHost
-import okio.utf8Size
 
 /**
  * A HostnameVerifier consistent with [RFC 2818][rfc_2818].
@@ -96,7 +95,13 @@ object OkHostnameVerifier : HostnameVerifier {
     }
 
   /** Returns true if the [String] is ASCII encoded (0-127). */
-  private fun String.isAscii() = length == utf8Size().toInt()
+  private fun String.isAscii(): Boolean {
+    for (i in 0 until length) {
+      val c = this[i]
+      if (c >= '\u0080') return false
+    }
+    return true
+  }
 
   /**
    * Returns true if [hostname] matches the domain name [pattern].

okhttp/src/jvmTest/kotlin/okhttp3/internal/tls/HostnameVerifierTest.kt

@@ -803,6 +803,21 @@ class HostnameVerifierTest {
     assertThat(localVerifier.verify("\uD83D\uDCA9.com", session)).isFalse()
   }
 
+  @Test fun verifyMalformedSurrogateHostname() {
+    // A hostname with an unpaired UTF-16 surrogate is not ASCII and must be rejected, not
+    // matched against the wildcard. https://github.com/square/okhttp/issues/6357
+    val heldCertificate =
+      HeldCertificate
+        .Builder()
+        .commonName("Foo Corp")
+        .addSubjectAlternativeName("*.com")
+        .build()
+    val session = session(heldCertificate.certificatePem())
+    assertThat(verifier.verify("example.com", session)).isTrue()
+    assertThat(verifier.verify("\uD800.com", session)).isFalse()
+    assertThat(verifier.verify("\uDC00.com", session)).isFalse()
+  }
+
   @Test fun verifyAsIpAddress() {
     // IPv4
     assertThat("127.0.0.1".canParseAsIpAddress()).isTrue()