Rayified: Delay chopping out a substring, check primitives?

I guess I could validate that the primitive code is the final character
in the string. start == end - 1...

core/src/main/java/com/threerings/io/ObjectInputStream.java

@@ -279,24 +279,28 @@ public class ObjectInputStream extends DataInputStream
         throws IOException
     {
         // strip array prefixes to get the component type descriptor
-        int start = 0;
-        while (start < cname.length() && cname.charAt(start) == '[') {
+        int start = 0, end = cname.length();
+        while (start < end && cname.charAt(start) == '[') {
             start++;
         }
-        String desc = cname.substring(start);
-
-        // primitive descriptors (I, Z, B, S, C, J, F, D) are always safe
-        if (!desc.startsWith("L") || !desc.endsWith(";")) {
-            return;
-        }
+        if (start < end) {
+            switch (cname.charAt(start)) {
+            default: break;
+            case 'I': case 'Z': case 'B': case 'S': case 'C': case 'J': case 'F': case 'D':
+                return; // primitive descriptors (I, Z, B, S, C, J, F, D) are always safe
 
+            case 'L':
+                if (cname.endsWith(";")) {
                     // extract the class name from "Lcom.threerings.Foo;"
-        String className = desc.substring(1, desc.length() - 1);
+                    String className = cname.substring(start + 1, end - 1);
                     for (String prefix : _allowedPrefixes) {
                         if (className.startsWith(prefix)) {
                             return;
                         }
                     }
+                }
+            }
+        }
 
         log.warning("Blocked deserialization of non-whitelisted class",
             "code", code, "class", cname);