read(io, Char): fix read with too many leading ones

Fixes #50532

base/io.jl

@@ -884,10 +884,11 @@ end
 
 function read(io::IO, ::Type{Char})
     b0 = read(io, UInt8)::UInt8
-    l = 8(4-leading_ones(b0))
+    l::UInt8 = leading_ones(b0)
     c = UInt32(b0) << 24
-    if l < 24
+    if 2 ≤ l ≤ 4
         s = 16
+        l = 8(4-l)
         while s ≥ l && !eof(io)::Bool
             peek(io) & 0xc0 == 0x80 || break
             b = read(io, UInt8)::UInt8

test/char.jl

@@ -1,7 +1,6 @@
 # This file is a part of Julia. License is MIT: https://julialang.org/license
 
 @testset "basic properties" begin
-
     @test typemax(Char) == reinterpret(Char, typemax(UInt32))
     @test typemin(Char) == Char(0)
     @test typemax(Char) == reinterpret(Char, 0xffffffff)
@@ -214,6 +213,27 @@ end
     end
 end
 
+# issue #50532
+@testset "invalid read(io, Char)" begin
+    # byte values with different numbers of leading bits
+    B = UInt8[
+        0x3f, 0x4d, 0x52, 0x63, 0x81, 0x83, 0x89, 0xb6,
+        0xc0, 0xc8, 0xd3, 0xe3, 0xea, 0xeb, 0xf0, 0xf2,
+        0xf4, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
+    ]
+    for b1 in B, b2 in B, t = 0:3
+        bytes = [b1, b2]
+        append!(bytes, rand(B, t))
+        s = String(bytes)
+        io = IOBuffer(s)
+        chars = Char[]
+        while !eof(io)
+            push!(chars, read(io, Char))
+        end
+        @test collect(s) == chars
+    end
+end
+
 @testset "overlong codes" begin
     function test_overlong(c::Char, n::Integer, rep::String)
         if isvalid(c)