During the de-serialization of MessageFormat, an offset greater than the pattern length should not be allowed. Using said format can later throw a SIOOBE down the line. It seems that the existing check in readObject is off by 1.